CVE-2025-26342
Published: 12 February 2025
Summary
CVE-2025-26342 is a critical-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Q-Free Maxtime. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 22.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-2 (Account Management).
Deeper analysis
CVE-2025-26342 is a missing authentication vulnerability (CWE-306) affecting the file maxprofile/accounts/routes.lua in Q-Free MaxTime versions up to and including 2.11.0. The flaw resides in a critical function that handles user account creation and permits unauthenticated access over the network, resulting in a CVSS 3.1 base score of 9.8.
An unauthenticated remote attacker can send crafted HTTP requests to the affected endpoint and create arbitrary user accounts, including those with administrator privileges. Successful exploitation grants the attacker full administrative control over the MaxTime instance without requiring any prior credentials or user interaction.
A detailed advisory published by Nozomi Networks at the referenced URL describes the issue and is the primary source of public information on the vulnerability. The EPSS score remains low, with a recorded peak of 0.0162 and a current value of 0.0099, indicating limited observed exploitation interest to date.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4154
Vulnerability details
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/accounts/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to create arbitrary users, including administrators, via crafted HTTP requests.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing authentication in web application allows unauthenticated remote creation of arbitrary local administrator accounts, enabling T1190 (Exploit Public-Facing Application), T1068 (Exploitation for Privilege Escalation), and T1136.001 (Create Account: Local Account).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
AC-14 directly mandates identification and restriction of critical functions like user creation that are permitted without authentication, preventing unauthenticated arbitrary account creation.
AC-3 enforces access control policies to block unauthenticated remote attackers from accessing the vulnerable user creation endpoint in maxprofile/accounts/routes.lua.
AC-2 governs account management processes to ensure only authorized entities can create users, including administrators, mitigating exploitation of the missing authentication.