CVE-2025-71454
Medium
Description
vtenext before 25.02.2 contains a cross-site request forgery protection bypass because csrf_check() in include/utils/VteCsrf.php skips __csrf_token validation for non-POST requests. Attackers can induce a logged-in user to open a crafted link sending state-changing GET requests, which handlers read from $_REQUEST, performing actions as that user.
SeverityMedium
CVSS6.5
Exploit probability—
ProductVtenext
PublishedNov 4, 2026
First seenNov 4, 2026
Weakness typeCWE-352Cross-site request forgery (CSRF)
How to fix
Update
- vtenext vtenext25.02.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| vtenext vtenext | v < 25.02.2 | 25.02.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.