CVE-2025-31991
Medium
Description
Rate Limiting for attempting a user login is not being properly enforced, making HCL DevOps Velocity susceptible to brute-force attacks past the unsuccessful login attempt limit. This vulnerability is fixed in 5.1.7.
SeverityMedium
CVSS6.8
Exploit probability—
ProductHcltech Devops Velocity
PublishedApr 13, 2026
First seenApr 13, 2026
Weakness typeCWE-307CWE-307
How to fix
Update
- hcltech devops_velocity5.1.7 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| hcltech devops_velocity | v < 5.1.7 | 5.1.7 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.