CVE-2025-26499
Under heavy system utilization a random race condition can occur during authentication or token refresh operation. This flaw allows one user to be granted a token intended for another user, resulting in impersonation until the session is ended. This flaw cannot be intentionally exploited due to the required concurring action by two users. However, if the event occurs a user would be inadvertently exposed to another user’s system rights and data access.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6
- CVSS vector
- CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
- EPSS probability
- 0.14%
- CWE
- CWE-270
- Published
- 2025-09-11
- Last modified
- 2026-03-13
Affected products
- Wind River Studio Developer Wind River Studio Developer
Weakness type
Related vulnerabilities
- CVE-2026-9560 — Privilege escalation via background service of OpenVPN Connect 3.5.1 through 3.8.1 on macOS allows...
- CVE-2026-34853 — Permission bypass vulnerability in the LBS module....
- CVE-2025-55210 — FreePBX API has a Privilege Escalation Error in GraphQL Allowing Authenticated Users to Access Additional Scopes
- CVE-2025-60721 — Windows Administrator Protection Elevation of Privilege Vulnerability
- CVE-2025-9408 — Userspace privilege escalation vulnerability on Cortex M
- CVE-2025-46406 — A Privilege Context Switching Error (CWE-270) in the Command Center Server could allow a privileged...
- CVE-2025-49583 — XWiki provides no warning when granting XWiki.Notifications.Code.NotificationEmailRendererClass admin right
- CVE-2025-49581 — XWiki allows remote code execution through default value of wiki macro wiki-type parameters