CVE-2025-13806 is a high severity improper authorization flaw (CVSS 7.3) in nutzam NutzBoot (up to 2.6.0-SNAPSHOT), affecting the Transaction API in the demo file EthModule.java (nutzboot-demo-simple-web3j), through the from, to and wei arguments. No fixed version is listed, so cut exposure and check the vendor for a patch.
What's affected
The affected component is the Transaction API in the demo file EthModule.java (nutzboot-demo-simple-web3j), through the from, to and wei arguments. The record says manipulating those arguments leads to improper authorization and that remote exploitation is possible. Affected versions run up to 2.6.0-SNAPSHOT.
Affected version: up to 2.6.0-SNAPSHOT. The record names no fixed version or vendor patch, so check the vendor site before assuming one exists.
The CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. The attack vector is the network, and the vector lists no privileges required, so an unauthenticated visitor who can reach the service is in scope. The weakness classes are CWE-266, CWE-285, CWE-863.
The CVE record states that the exploit has been disclosed publicly. That is not the same as exploitation in the wild, which the record does not report, and the CISA Known Exploited Vulnerabilities flag is false. Still, public details lower the effort needed to attack an exposed instance.
How to check if you're exposed
NutzBoot is a Java framework, and the affected file sits in a demo module (nutzboot-demo-simple-web3j) inside the project. First work out whether you ship that demo code or built something from it.
grep -rn "EthModule" --include=*.java . | head
mvn dependency:tree | grep -i nutzboot
The first command finds copies of the demo class in your repositories. The second lists the NutzBoot artifacts your build pulls in. If you only depend on the framework starters and not on the demo, this CVE may not touch your deployment, but verify by searching your source and your deployed artifacts.
Reachability matters here. A vulnerable class that is never packaged or never exposed over HTTP is a different risk from one that is live. Safeguard's reachability analysis is built for that question.
What to do now
- Search your repositories and build artifacts for the demo module or copies of EthModule.java.
- Remove the demo endpoint from anything that runs outside a developer laptop.
- If you built a transfer feature from this sample, add authentication and an ownership check so the caller can only move funds from their own account.
- Confirm that wallet keys and node credentials used by the service are not shared with other systems, and rotate them if the endpoint was ever exposed.
- Check the NutzBoot project for a fixed release, and update when it is available. The record names none.
Why it matters
Improper authorization (CWE-266, CWE-285, CWE-863) means the code performs a sensitive action without checking that the caller is allowed to ask for it. Here the Transaction API accepts the from, to and wei values, and the record says manipulating them leads to the authorization flaw.
It is a sample project, so the realistic risk depends on whether someone copied it into production. That happens more often than maintainers expect. Demo code lives in repositories for years, and a quick search of your own source is the cheapest control you have.
Try it yourself
The demo walks through checking whether a vulnerability is exploitable in your own setup.
Click through it at your own pace, or open it full screen.
Quick check
Is this a vulnerability in the NutzBoot framework itself?
The record places it in a demo module file, not in the framework core. Check your own use, because demo code is often copied into real services.
Why is the score 7.3 with no login needed?
The vector lists no privileges required and limited impact on confidentiality, integrity and availability. The attack vector is the network, and the vector lists no privileges required, so an unauthenticated visitor who can reach the service is in scope.
Sources
- Gold vulnerability page for CVE-2025-13806
- CVE record for CVE-2025-13806 as published by its CNA, with a published date of 2025-12-01
- Free in-browser dependency scan: gold.safeguard.sh/scan
Last reviewed: 19 October 2026.
