Authentication Bypass

🗓️ 09 Feb 2025 18:00:50Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 6 Views

NGINX vulnerability allows authentication bypass using shared TLS session states via session resumption.

Reporter	Title	Published	Views	Family All 115
ibm	Security Bulletin: Vulnerability in nginx affects IBM Netezza Appliance	24 Dec 202509:18	–	ibm
ibm	Security Bulletin: Vulnerabilities exists in IBM Netezza Performance Server Replication Services	27 Feb 202619:55	–	ibm
ibm	Security Bulletin: Security vulnerability in nginx affects IBM Robotic Process Automation for Cloud Pak	23 Mar 202613:58	–	ibm
ibm	Security Bulletin: IBM Maximo Application Suite - Visual Inspection component was using python,nginx and packages which were vulnerable to CVE-2025-4435, CVE-2025-23419, CVE-2025-4330, CVE-2025-4138, CVE-2025-47273	6 Feb 202606:19	–	ibm
freebsd	nginx-devel -- SSL session reuse vulnerability	5 Feb 202500:00	–	freebsd
nessus	Amazon Linux 2023 : nginx, nginx-all-modules, nginx-core (ALAS2023-2025-842)	26 Feb 202500:00	–	nessus
nessus	Amazon Linux 2 : nginx (ALASNGINX1-2025-008)	28 Mar 202500:00	–	nessus
nessus	Azure Linux 3.0 Security Update: nginx (CVE-2025-23419)	21 Feb 202500:00	–	nessus
nessus	Debian dla-4091 : libnginx-mod-http-auth-pam - security update	25 Mar 202500:00	–	nessus
nessus	Fedora 40 : nginx / nginx-mod-fancyindex / nginx-mod-modsecurity / etc (2025-016ed44ddc)	15 Feb 202500:00	–	nessus

Vulners

Node

AND

nginx nginxMatch1.18.0-6debian

debian debian_linuxMatch999

AND

nginx nginxMatch1.22.1-r0os

nginx nginxMatch1.16.1-r8os

nginx nginxMatch1.20.1-r4os

nginx nginxMatch1.20.2-r1os

nginx nginxMatch1.26.1-r2os

nginx nginxMatch1.24.0-r10os

nginx nginxMatch1.24.0-r17os

nginx nginxMatch1.22.0-r0os

nginx nginxMatch1.24.0-r6os

nginx nginxMatch1.20.1-r1os

nginx nginxMatch1.26.0-r1os

nginx nginxMatch1.22.0-r8os

nginx nginxMatch1.24.0-r2os

nginx nginxMatch1.24.0-r0os

nginx nginxMatch1.24.0-r13os

nginx nginxMatch1.22.0-r1os

nginx nginxMatch1.20.1-r3os

nginx nginxMatch1.26.2-r2os

nginx nginxMatch1.24.0-r18os

nginx nginxMatch1.20.2-r0os

nginx nginxMatch1.22.0-r7os

nginx nginxMatch1.26.2-r3os

nginx nginxMatch1.26.2-r0os

nginx nginxMatch1.20.1-r6os

nginx nginxMatch1.26.0-r2os

nginx nginxMatch1.24.0-r9os

nginx nginxMatch1.20.1-r12os

nginx nginxMatch1.24.0-r14os

nginx nginxMatch1.26.0-r0os

nginx nginxMatch1.24.0-r1os

nginx nginxMatch1.22.0-r5os

nginx nginxMatch1.22.0-r3os

nginx nginxMatch1.20.1-r5os

nginx nginxMatch1.20.1-r7os

nginx nginxMatch1.18.0-r0os

nginx nginxMatch1.24.0-r12os

nginx nginxMatch1.20.1-r9os

nginx nginxMatch1.20.1-r13os

nginx nginxMatch1.26.2-r4os

nginx nginxMatch1.18.0-r15os

nginx nginxMatch1.20.2-r2os

nginx nginxMatch1.18.0-r14os

nginx nginxMatch1.20.0-r0os

nginx nginxMatch1.26.1-r3os

nginx nginxMatch1.20.1-r0os

nginx nginxMatch1.24.0-r16os

nginx nginxMatch1.26.1-r0os

nginx nginxMatch1.20.1-r2os

nginx nginxMatch1.22.0-r6os

nginx nginxMatch1.24.0-r11os

nginx nginxMatch1.22.0-r2os

alpinelinux alpine_linuxMatchedge

AND

nginx nginxMatch1.26.0-r0os

nginx nginxMatch1.26.2-r0os

nginx nginxMatch1.26.0-r2os

nginx nginxMatch1.26.0-r1os

nginx nginxMatch1.26.1-r0os

alpinelinux alpine_linuxMatch3.20

AND

nginx nginxMatch1.26.2-r0os

nginx nginxMatch1.26.2-r3os

nginx nginxMatch1.26.2-r2os

nginx nginxMatch1.26.2-r4os

nginx nginxMatch1.26.2-r1os

alpinelinux alpine_linuxMatch3.21

AND

nginx nginxMatch1.18.0-6debian

debian debian_linuxMatch11

Source	Link
lists	www.lists.debian.org/debian-lts-announce/2025/03/msg00017.html
security-tracker	www.security-tracker.debian.org/tracker/CVE-2025-23419
my	www.my.f5.com/manage/s/article/K000149173
openwall	www.openwall.com/lists/oss-security/2025/02/05/8

27 Jan 2026 15:17Current

6.9Medium risk

Vulners AI Score6.9

CVSS 3.14.3

CVSS 45.3

EPSS0.02646

SSVC