CVE-2025-27580

NIH BRICS (aka Biomedical Research Informatics Computing System) through 14.0.0-67 generates predictable tokens (that depend on username, time, and the fixed 7Dl9#dj- string) and thus allows unauthenticated users with a Common Access Card (CAC) to escalate privileges and compromise any account, including administrators.

Affected

NIH · BRICS

CVSS v3.1 MITRE

7.5 HIGHCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.71% chance of exploitation in the next 30 days, 53rd percentile

Published

2025-04-23

Updated

2025-04-24

Proof-of-concept exploits (1)

• TrustStackSecurity/CVE-2025-275800★ · 2025-06-06

References

• CVE Record
• NVD entry