CVE-2025-15105: maxun Hardcoded Credentials — Exploit

Description

A security flaw has been discovered in getmaxun maxun up to 0.0.28. Impacted is an unknown function of the file /getmaxun/maxun/blob/develop/server/src/routes/auth.ts. Performing manipulation of the argument api_key results in use of hard-coded cryptographic key . Remote exploitation of the attack is possible. The attack is considered to have high complexity. The exploitability is considered difficult. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.

Is your site exposed to CVE-2025-15105?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

3.7

LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness Type (CWE)

CWE-320 CWE-320

CWE-321 CWE-321

CWE-798 CWE-798

Affected Products

Vendor	Product	Versions
maxun	maxun	< 0.0.28

References

Exploits

https://gist.github.com/H2u8s/40be31987e52fc81076b6bfcfbdf3cd6

Other References

https://vuldb.com/?ctiid.338476 https://vuldb.com/?id.338476 https://vuldb.com/?submit.710256

Frequently Asked Questions

What is CVE-2025-15105? +

A security flaw has been discovered in getmaxun maxun up to 0.0.28. Impacted is an unknown function of the file /getmaxun/maxun/blob/develop/server/src/routes/auth.ts. Performing manipulation of the argument api_key results in use of hard-coded cryptographic key . Remote exploitation of the attack is possible. The attack is considered to have high complexity. The exploitability is considered difficult. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way. It has a CVSS v3.1 base score of 3.7 (LOW).

How severe is CVE-2025-15105? +

CVE-2025-15105 has a CVSS v3.1 score of 3.7 out of 10, rated LOW. This is a low-severity vulnerability with limited impact.

What products are affected by CVE-2025-15105? +

CVE-2025-15105 affects products from maxun, specifically: maxun. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2025-15105? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-36391 9.1

MileSight DeviceHub - CWE-320: Key Management Errors may allow Authentication Bypass and Man-In-The-Middle Traffic

CVE-2026-6580 7.3

A security vulnerability has been detected in liangliangyy DjangoBlog up to 2.1.0.0. Affected is an unknown function of the file …

CVE-2026-56254 7.0

In @capgo/capacitor-updater (Cap-go/capgo) before 12.128.2, the end-to-end encryption scheme distributes the private key to each device that downloads the app. …

CVE-2024-40593 6.0

A key management errors vulnerability in Fortinet FortiAnalyzer 7.4.0 through 7.4.2, FortiAnalyzer 7.2.0 through 7.2.5, FortiAnalyzer 7.0 all versions, FortiAnalyzer …

CVE-2025-11290 5.6

A vulnerability was identified in CRMEB up to 5.6.1. This affects an unknown function of the component JWT HMAC Secret …

CVE-2025-13877 5.6

A vulnerability was detected in nocobase up to 1.9.4/2.0.0-alpha.37. The affected element is an unknown function of the file nocobase\packages\core\auth\src\base\jwt-service.ts …

CVE-2025-15105