CVE-2025-3268 is a medium severity (CVSS 5.3) improper authentication flaw in qinguoyi TinyWebServer up to version 1.0. The m_url_real value in http/http_conn.cpp is mishandled in a way that weakens authentication. The record names no fix, so keep it off untrusted networks and review the code.
What's affected
qinguoyi TinyWebServer up to and including 1.0, per the CVE record. The file is http/http_conn.cpp and the manipulated value is m_url_real.
The vector shows network access, low complexity, no privileges and no user interaction, with low impact on confidentiality only. The record says the exploit has been disclosed publicly and may be used, and does not claim exploitation in the wild.
No fixed version is named in the record. The same project has a stack overflow in the same file, CVE-2025-3266. A project with two entries in one file usually warrants a full review, not two small fixes.
How to check if you're exposed
Check whether you run TinyWebServer or a derivative. Search your source trees:
grep -rn 'm_url_real' --include=*.cpp .
If found, read how the requested path is built and which checks happen before a file is returned. Access checks are most reliable when they are applied to the final path that will be served.
Test, in a safe environment, whether restricted pages can be fetched without a login.
What to do now
- Take the server off the public internet, or put it behind a reverse proxy that enforces authentication.
- Review the code that resolves request paths and apply access checks after resolution.
- Serve only a dedicated directory of public files, with nothing sensitive in the document root.
- Apply the fix for CVE-2025-3266 in the same review.
- Replace the project with a maintained web server for any real workload.
Why it matters
The class is CWE-287 (Improper Authentication). The program does not reliably tie access to a verified identity for the path being requested. Authentication that can be skipped for some requests protects nothing for those requests.
Authentication flaws score lower when they leak only a little data, as here, but they open the door to the rest. It is best to fix them with the memory safety issue in the same code, since an attacker who can skip a login can often reach the vulnerable parser too.
The record does not mark this CVE as CISA KEV and makes no claim of exploitation in the wild.
Quick check
Why fix this alongside CVE-2025-3266?
Both are in the same file, and an authentication gap makes it easier to reach the overflow. Reviewing them together is cheaper and safer.
Sources
Last reviewed: 18 October 2026.
