CVE-2025-69246
Published: 16 March 2026
Summary
CVE-2025-69246 is a medium-severity Improper Restriction of Excessive Authentication Attempts (CWE-307) vulnerability in Raytha Raytha. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Brute Force (T1110); ranked at the 29.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-7 (Unsuccessful Logon Attempts) and SC-5 (Denial-of-service Protection).
Deeper analysis
CVE-2025-69246 is a critical vulnerability in Raytha CMS, published on 2026-03-16, stemming from the absence of any brute force protection mechanism on its login functionality. This allows attackers to send unlimited automated logon requests without lockout, throttling, or step-up challenges being triggered. Assigned CWE-307 and a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the flaw affects Raytha CMS versions prior to 1.4.6.
Any remote attacker without privileges or user interaction can exploit this vulnerability over the network with low complexity. Successful exploitation enables brute-forcing login credentials, potentially granting full administrative access to the CMS, leading to high impacts on confidentiality, integrity, and availability through unauthorized data access, modification, or disruption.
The issue was addressed in Raytha CMS version 1.4.6. Additional details are available in advisories from CERT.pl at https://cert.pl/en/posts/2026/03/CVE-2025-69236 and the vendor site at https://raytha.com. Security practitioners should upgrade to the patched version and consider implementing supplementary brute force mitigations such as rate limiting or CAPTCHA on exposed instances.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-208717
- 🇵🇱 CERT-PL: cert.pl
Vulnerability details
Raytha CMS does not have any brute force protection mechanism implemented. It allows an attacker to send multiple automated logon requests without triggering lockout, throttling, or step-up challenges. This issue was fixed in version 1.4.6.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Directly enables unlimited automated credential guessing against the login endpoint due to missing rate limiting/lockout.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces limits on consecutive invalid logon attempts and automatic account lockout to prevent brute-force credential guessing.
Provides denial-of-service protections such as rate limiting and throttling to block excessive automated login requests.
Implements adaptive authentication mechanisms like step-up challenges to mitigate risks from repeated failed logon attempts.