CVE-2025-15106

MediumCVSS 6.3

Published: 27/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 06/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.36%

28th percentile - higher than 28% of all known CVEs

Summary

A weakness in getmaxun maxun (up to 0.0.28) affects the router.get function in server/src/routes/auth.ts of the Authentication Endpoint component. Manipulation can lead to improper authorization. The attack can be executed remotely, and the exploit has been made public.

Risk Assessment

Improper authorization may allow unauthorized users to access protected resources or functions, potentially leading to system security breaches.

Recommendation

Immediately apply patches or update to a fixed version, and review authorization logs for potential misuse.

Other vulnerabilities in maxun

CVE-2026-56767High
A vulnerability in Maxun before version 0.0.42 allows authenticated users to access other users' robots and OAuth tokens by bypassing ownership checks in storage and webhook API handlers. Attackers can read plaintext Google and Airtable access tokens, modify, delete, or execute other users' robots.

Original NVD description (English source)

A weakness has been identified in getmaxun maxun up to 0.0.28. The affected element is the function router.get of the file server/src/routes/auth.ts of the component Authentication Endpoint. Executing manipulation can lead to improper authorization. The attack can be executed remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS