/Vulnerability Library

Versa Concerto Actuator Endpoint - Authentication Bypass

CVE-2025-34026
Verified

Description

An authentication bypass vulnerability affected the Spring Boot Actuator endpoints in Versa Concerto due to improper handling of the X-Real-Ip header.Attackers could access restricted endpoints by omitting this header.The issue allowed unauthorized access to sensitive functionality, highlighting the need for proper header validation.

Severity

Critical

CVSS Score

7.5

Exploit Probability

82%

Affected Product

concerto

Published Date

May 21, 2025

Template Author

iamnoooob, rootxharsh, parthmalhotra
+1

CVE-2025-34026.yaml
7.5Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVE ID:
cve-2025-34026
CWE ID:
cwe-288

References

https://projectdiscovery.io/blog/versa-concerto-authentication-bypass-rce/https://security-portal.versa-networks.com/emailbulletins/6830f94328defa375486ff2ehttps://www.cve.org/CVERecord?id=CVE-2025-34026

Remediation Steps

Upgrade to the latest Versa Concerto version that properly validates authentication for all Actuator endpoints regardless of header presence.