---
cve: "CVE-2025-49825"
severity: "CRITICAL"
cvss: 9.8
epss: "7.9%"
vendor: "gravitational"
kev: false
exploited: false
published: "2025-06-17 22:15:49"
tags: [cve, security, critical]
source: tsecurity.de CVE-Dossier
exported: "2026-10-28T10:49:24+01:00"
---

# CVE-2025-49825

> 9.8 CRITICAL · 🧪 PoC

## Beschreibung

Teleport provides connectivity, authentication, access controls and audit for infrastructure. Community Edition versions before and including 17.5.1 are vulnerable to remote authentication bypass. At time of posting, there is no available open-source patch.

## CNA-Record (Kanon, cvelistV5)

- CNA: **GitHub_M**
- State: PUBLISHED
- Stand: 2025-06-18 13:40:25
- CNA-CVSS: **9.8** (`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **yes**
  - Technical Impact: **total**

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Hoch | bad |
| I Integrität | Hoch | bad |
| A Verfügbarkeit | Hoch | bad |

## Schwachstellen-Klasse

- **CWE-863** — Incorrect Authorization
  The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

## Referenzen

- <https://github.com/gravitational/teleport/security/advisories/GHSA-8cqv-pj7f-pwpc>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2025-49825/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_