CVE-2025-40807

MediumCVSS 6.3

Published: 09/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.30%

21th percentile - higher than 21% of all known CVEs

Summary

Gridscale X Prepay (all versions < V4.2.1) is vulnerable to capture-replay of authentication tokens. This could allow an authenticated but already locked-out user to establish still valid user sessions.

Risk Assessment

A locked-out user could regain access to the system by replaying a captured token, violating account lockout policies and potentially leading to unauthorized actions.

Recommendation

Update Gridscale X Prepay to version V4.2.1 or later. Additionally, consider invalidating tokens upon account lockout.

Other vulnerabilities in Gridscale X Prepay

CVE-2025-40806Medium
A vulnerability in Gridscale X Prepay (versions before 4.2.1) allows user enumeration through distinguishable responses. A remote unauthenticated attacker can determine if a user is valid, enabling brute force attacks.

Original NVD description (English source)

A vulnerability has been identified in Gridscale X Prepay (All versions < V4.2.1). The affected application is vulnerable to capture-replay of authentication tokens. This could allow an authenticated but already locked-out user to establish still valid user sessions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS