CVE-2025-58130
Published: 12 December 2025
Summary
CVE-2025-58130 is a critical-severity Insufficiently Protected Credentials (CWE-522) vulnerability in Apache Fineract. Its CVSS base score is 9.1 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 26.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 IA-5 (Authenticator Management) and SC-28 (Protection of Information at Rest).
Deeper analysis
Apache Fineract, an open-source core banking platform, is affected by CVE-2025-58130, an Insufficiently Protected Credentials vulnerability classified under CWE-522. This flaw impacts all versions of Apache Fineract through 1.11.0, where credentials are not adequately safeguarded, potentially exposing sensitive authentication data. The vulnerability carries a CVSS v3.1 base score of 9.1, indicating critical severity due to its high impact on confidentiality and integrity.
Remote attackers require no privileges, authentication, or user interaction to exploit this issue over the network with low complexity. Successful exploitation allows unauthenticated adversaries to access protected credentials, enabling high-level compromise of confidentiality by reading sensitive data and integrity by modifying it, without affecting availability.
Apache advisories confirm the issue is fixed in version 1.12.1, with users strongly encouraged to upgrade to the latest release, 1.13.0, for comprehensive protection. Relevant discussions are available in the Apache mailing list announcement and OSS-Security mailing list post.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-203067
Vulnerability details
Insufficiently Protected Credentials vulnerability in Apache Fineract. This issue affects Apache Fineract: through 1.11.0. The issue is fixed in version 1.12.1. Users are encouraged to upgrade to version 1.13.0, the latest release.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote exploitation of a public-facing banking platform vulnerability enables initial access (T1190) and specifically facilitates credential collection via software exploitation (T1212) by exposing and allowing modification of insufficiently protected credentials.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the CVE by requiring identification, reporting, and timely patching of the insufficiently protected credentials flaw in Apache Fineract versions through 1.11.0.
Ensures authenticators such as credentials in Apache Fineract are securely managed, protected from unauthorized disclosure, and properly handled to prevent exposure to unauthenticated attackers.
Implements cryptographic protection for credentials at rest, directly addressing the insufficient protection that allows remote unauthenticated access in vulnerable Fineract versions.