CVE-2025-56224
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
A lack of rate limiting in the One-Time Password (OTP) verification endpoint of SigningHub v8.6.8 allows attackers to bypass verification via a bruteforce attack.
Risk Assessment
The risk involves potential unauthorized access to user accounts or execution of sensitive operations without knowing the correct OTP, which could lead to data confidentiality and integrity breaches.
Recommendation
It is recommended to immediately implement rate limiting for the OTP verification endpoint and consider additional security measures such as CAPTCHA.
Other vulnerabilities in SigningHub
See all- CVE-2025-56218Critical
An arbitrary file upload vulnerability in SigningHub v8.6.8 allows attackers to execute arbitrary code via uploading a crafted PDF file.
- CVE-2025-56223High
Lack of rate limiting in the /Home/UploadStreamDocument component of SigningHub v8.6.8 allows attackers to cause a Denial of Service (DoS) by uploading an excessive number of files.
- CVE-2025-56219High
Incorrect access control in SigningHub v8.6.8 allows attackers to arbitrarily add user accounts without rate limiting, leading to resource exhaustion and Denial of Service (DoS).
Original NVD description (English source)
A lack of rate limiting in the One-Time Password (OTP) verification endpoint of SigningHub v8.6.8 allows attackers to bypass verification via a bruteforce attack.