CVE-2025-8350
Published: 19 February 2026
Summary
CVE-2025-8350 is a critical-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Gov (inferred from references). Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 41.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and IA-2 (Identification and Authentication (Organizational Users)).
Deeper analysis
CVE-2025-8350 is an Execution After Redirect (EAR) and Missing Authentication for Critical Function vulnerability in Inrove Software and Internet Services' BiEticaret CMS. This issue enables Authentication Bypass and HTTP Response Splitting. It affects BiEticaret CMS versions from 2.1.13 through 19022026.
Remote attackers require no privileges or user interaction to exploit this vulnerability over the network with low complexity, as indicated by its CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Successful exploitation can result in high impacts to confidentiality, integrity, and availability, allowing attackers to bypass authentication mechanisms, manipulate HTTP responses, and potentially achieve full compromise of the affected system.
The vendor was contacted early regarding this disclosure but provided no response. Advisory details are published by the Turkish National Cyber Incident Response Center (USOM) at https://www.usom.gov.tr/bildirim/tr-26-0077. The vulnerability maps to CWE-306 (Missing Authentication for Critical Function) and CWE-698 (Execution After Redirect).
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-207679
Vulnerability details
Execution After Redirect (EAR), Missing Authentication for Critical Function vulnerability in Inrove Software and Internet Services BiEticaret CMS allows Authentication Bypass, HTTP Response Splitting. This issue affects BiEticaret CMS: from 2.1.13 through 19022026. NOTE: The vendor was contacted early about…
more
this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability allows unauthenticated attackers to bypass authentication and achieve full system compromise via exploitation of a public-facing web application (CMS), directly mapping to T1190: Exploit Public-Facing Application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces authentication and authorization decisions before granting access to critical functions, blocking the missing-auth bypass and EAR flaw.
Requires users to be identified and authenticated prior to accessing the system, directly mitigating the complete absence of authentication for critical CMS functions.
Enforces information-flow rules that would stop unauthorized redirects and HTTP response splitting used to bypass authentication.