GitHub Advisoryadvisory · PyPI

GHSA-j6g5-p62x-58hw vantage6 lacks brute-force protection on change password functionality

LOW Published 2025-06-12 Modified 2026-06-08 Official page ↗
Aliases
CVE-2025-43863
Ecosystem
PyPI
Packages
vantage6
Severity
Low
CVSS vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U
Weaknesses
CWE-307
Reviewed
2025-06-12

Affected packages

• PyPI vantage6: < 4.11.0 → fixed in 4.11.0

Description

Impact If attacker gets access to an authenticated session, they can try to brute-force the user password by using the change password functionality: they can call that route infinitely which will return the message that password is wrong until it is correct Patches This issue has been patched in version 4.11.0 Workarounds None

Related

Alias · CVE (1)

  • CVE-2025-43863 vantage6 is an open source framework built to enable, manage and deploy privacy enhancing technologies like Federated Learning and… vulnerability

Weakness · CWE (1)

  • CWE-307 Improper Restriction of Excessive Authentication Attempts weakness

References