CVE-2025-9803: lunary — Katalog CVE

csirt@kutim:~/threat-intel/cve/CVE-2025-9803

CVSS 8.8 · High EPSS 0,47%

Kerentanan Improper Authentication pada lunary. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

lunary-ai/lunary version 1.9.34 is vulnerable to an account takeover due to improper authentication in the Google OAuth integration. The application fails to verify the 'aud' (audience) field in the access token issued by Google, which is crucial for ensuring the token is intended for the application. This oversight allows attackers to use tokens issued to malicious applications to gain unauthorized access to user accounts. The issue is resolved in version 1.9.35.

Rincian

Terbit di NVD: 25 November 2025
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-287: Improper Authentication
CWE-863: Incorrect Authorization
EPSS (30 hari): 0,47% peluang dieksploitasi; lebih tinggi dari 39,1% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
lunary	lunary	Versi 1.9.34

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://huntr.com/bounties/4734f35f-514c-4d10-98fa-3a54514f6af6 exploit · advisory pihak ketiga
https://github.com/lunary-ai/lunary/commit/95a2cc8e012bf5f089edbfa072ba66dcb7e10d91 broken link

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.