CVE-2025-8855
Published: 14 November 2025
Summary
CVE-2025-8855 is a high-severity Authentication Bypass by Assumed-Immutable Data (CWE-302) vulnerability in Gov (inferred from references). Its CVSS base score is 8.1 (High).
Operationally, ranked at the 24.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-197605
Vulnerability details
Authorization Bypass Through User-Controlled Key, Weak Password Recovery Mechanism for Forgotten Password, Authentication Bypass by Assumed-Immutable Data vulnerability in Optimus Software Brokerage Automation allows Exploiting Trust in Client, Authentication Bypass, Manipulate Registry Information. This issue affects Brokerage Automation: before 1.1.71.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Per-request decision making makes it harder to bypass authorization using user-controlled keys without proper validation in the decision process.
Consistent enforcement of approved authorizations makes bypassing via user-controlled keys ineffective.
Establishing procedures for lost or compromised authenticators addresses weak password recovery mechanisms.
Proper authentication for non-organizational users counters bypasses relying on assumed-immutable data.