CVE-2025-55796

The openml/openml.org web application (version v2.0.20241110 ) is vulnerable to account takeover due to the use of predictable MD5-based tokens for critical workflows, including signup confirmation, password resets, and email changes. The root cause is that these tokens are generated by hashing a...

CVE-2025-55795

The openml/openml.org web application version v2.0.20241110 is vulnerable to an improper access control flaw. The issue stems from the use of incremental user IDs combined with insufficient email ownership verification during email update workflows. An authenticated attacker with a lower user ID ...