/Vulnerability Library

Versa Concerto API Path Based - Authentication Bypass

CVE-2025-34027
Verified

Description

Authentication bypass in the Versa Concerto API, caused by URL decoding inconsistencies. It allowed unauthorized access to certain API endpoints by manipulating the URL path.This issue enabled attackers to bypass authentication controls and access restricted resources.

Severity

Critical

Exploit Probability

46%

Affected Product

concerto

Published Date

May 21, 2025

Template Author

iamnoooob, rootxharsh, parthmalhotra
+1

CVE-2025-34027.yaml
9.5Severity

CVSS Metrics

CVE ID:
cve-2025-34027
CWE ID:
cwe-367

References

https://projectdiscovery.io/blog/versa-concerto-authentication-bypass-rce/https://versa-networks.com/documents/datasheets/versa-concerto.pdfhttps://www.cve.org/CVERecord?id=CVE-2025-34027https://security-portal.versa-networks.com/emailbulletins/6830fa3f28defa375486ff2f

Remediation Steps

Upgrade to the latest Versa Concerto version that properly handles URL decoding and path validation in authentication checks.