CVE-2025-23408

Medium

Description

Weak Password Requirements vulnerability in Apache Fineract. This issue affects Apache Fineract: through 1.10.1. The issue is fixed in version 1.11.0. Users are encouraged to upgrade to version 1.13.0, the latest release.

SeverityMedium

CVSS6.5

Exploit probability—

Product

Apache Fineract

PublishedDec 12, 2025

First seenDec 12, 2025

Weakness typeCWE-521CWE-521

How to fix

Update

apache fineract1.11.0 or later

Vendor advisories

lists.apache.org/thread/bdlb6wl968yh1n48mr5npsk2spo6dncf

Affected products

Product	Affected versions	Fixed in
apache fineract	v < 1.11.0	1.11.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.