CVE-2025-27580

NIH BRICS (aka Biomedical Research Informatics Computing System) through 14.0.0-67 generates predictable tokens (that depend on username, time, and the fixed 7Dl9#dj- string) and thus allows unauthenticated users with a Common Access Card (CAC) to escalate privileges and compromise any account, including administrators.

CVSS v3.1

7.5 HIGHCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.68% chance of exploitation in the next 30 days, 50th percentile

Published

2025-04-23

Updated

2025-04-24

Proof-of-concept exploits (1)

• TrustStackSecurity/CVE-2025-275800★ · 2025-06-06

References

• CVE Record
• NVD entry

Related

• CVE-2025-2757
• CVE-2025-27581
• CVE-2025-2756
• CVE-2025-27590
• CVE-2025-27558
• CVE-2025-27591