Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:LSummary
CVE-2025-69614 is a critical-severity Weak Password Recovery Mechanism for Forgotten Password (CWE-640) vulnerability in Telekom Account Management Portal. Its CVSS base score is 9.4 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Valid Accounts (T1078); ranked at the 32th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to IA-12 (Identity Proofing) and IA-5 (Authenticator Management) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-69614 is an incorrect access control vulnerability stemming from activation token reuse on the password-reset endpoint of the Deutsche Telekom AG Telekom Account Management Portal. This flaw enables unauthorized password resets and full account takeover. It affects versions of the portal prior to 2025-10-27 and was assigned a CVSS v3.1 base score of 9.4 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L), with CWE-640: Weak Password Recovery Mechanism for Forgotten Password.
Remote attackers require no privileges, authentication, or user interaction to exploit the vulnerability over the network with low complexity. By reusing activation tokens, they can perform unauthorized password resets, achieving full account takeover. This results in high impacts to confidentiality and integrity, with low impact to availability.
The vulnerability was addressed in a fix released on 2025-10-31. For detailed mitigation guidance and patch deployment, refer to vendor advisories including https://www.telekom.com/en/company/data-privacy-and-security/news/acknowledgements-358300#R and https://gist.github.com/ethicalrohitt/b3e6d071aac8530459e8b3a5720bb832. The CVE was published on 2026-03-10.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-208506
Vulnerability Data
Incorrect Access Control via activation token reuse on the password-reset endpoint allowing unauthorized password resets and full account takeover. Affected Product: Deutsche Telekom AG Telekom Account Management Portal, versions before 2025-10-27, fixed 2025-10-31.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V7.4.3
Mitigating Controls (NIST 800-53 r5) AI
Identity proofing at appropriate assurance levels ensures forgotten-password recovery cannot succeed without strong verification of the user.
Authenticator management requires secure distribution, reset, and verification procedures that directly address weak password recovery flows.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Credential lifecycle management directly includes password reset/recovery flows.
Identity proofing is the core control that prevents weak or bypassed recovery mechanisms.
Authentication policy covers strength/MFA but does not address recovery path weaknesses.
Secure SDLC reduces implementation flaws but is not specific to password-recovery design.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Strong authentication-information lifecycle rules directly address weak password-recovery flows.
Secure-SDLC practices can embed strong recovery design, yet the control is broader than this single weakness.
Application-security requirements can mandate secure recovery flows, but the control covers many other requirements.
Secure-coding standards can prevent weak recovery implementations, yet the control is wider in scope.
Secure-authentication requirements include robust forgotten-password procedures.
Proper access-rights provisioning can limit who can trigger recovery, but does not fix the recovery mechanism itself.