CVE-2025-6505
High
Description
Unauthorized access and impersonation can occur in versions 4.6.2.3226 and below of Progress Software's Hybrid Data Pipeline Server on Linux. This vulnerability allows attackers to combine credentials from different sources, potentially leading to client impersonation and unauthorized access. When OAuth Clients perform an OAuth handshake with the Hybrid Data Pipeline Server, the server accepts client credentials from both HTTP headers and request parameters.
SeverityHigh
CVSS8.1
Exploit probability—
Product
Progress Hybrid Data Pipeline
PublishedJul 29, 2025
First seenJul 29, 2025
Weakness typeCWE-287Improper authentication
How to fix
Update
- progress hybrid_data_pipeline4.6.2.3275 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| progress hybrid_data_pipeline | v < 4.6.2.3275 | 4.6.2.3275 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.