CVE-2025-71457: Unauthenticated Password Reset in vtenext
A critical authentication bypass has been published for vtenext, an open-source CRM platform. Tracked as CVE-2025-71457 with a CVSS score of 9.8, the flaw affects vtenext 25.02 before 25.02.1 and was published to the National Vulnerability Database on November 4, 2026.
What the Flaw Is
According to the NVD description, the password recovery endpoint hub/rpwd.php accepts a password change request without verifying a reset token. An unauthenticated attacker who knows a valid user_name can send action=change_password to the RecoverPwd::displayChangePwd() handler and set a new password for that account.
In practice this means:
- No prior authentication or session is required.
- No reset token or email confirmation is checked.
- The only prerequisite is a valid username, which is often guessable (
admin) or discoverable through other CRM exposure.
Impact
Successful exploitation gives an attacker full control of any account, including administrators. For a CRM, that typically means access to customer records, contact data, deal history and attached documents, plus the ability to alter data or pivot to connected mail and integration credentials.
Affected Versions
| Product | Affected | Fixed |
|---|---|---|
| vtenext | 25.02 | 25.02.1 |
Recommended Actions
- Upgrade to vtenext 25.02.1 or later as soon as possible.
- If you cannot patch immediately, block external access to
hub/rpwd.phpat the reverse proxy or WAF, or restrict the CRM to VPN or trusted networks. - Review authentication and web server logs for requests to
hub/rpwd.phpcontainingaction=change_password, especially from unfamiliar IP addresses. - Force a password reset for administrator and privileged accounts if any suspicious requests are found, and invalidate active sessions.
- Enable MFA where the product or an upstream SSO layer supports it.