CVE-2025-49591 is a critical (CVSS 9.1) two-factor authentication bypass in CryptPad, the collaboration suite from XWiki. Before version 2025.3.0, 2FA could be skipped by anyone holding a victim's password through a flaw in path handling. Upgrade to CryptPad 2025.3.0 or later, which contains the fix.
What's affected
CryptPad versions before 2025.3.0, per the record and the project's GitHub advisory GHSA-xq5x-wgcm-3p33. Version 2025.3.0 is the patched release.
The record explains the cause at a high level. CryptPad did not enforce 2FA when a path parameter in a request was not the expected length, and an attacker could produce that condition by encoding a single character in the path. That meant the second factor was only checked on some shapes of request.
The impact depends on a precondition: the attacker needs the user's credentials first. The CVSS vector in the record shows no privileges and no user interaction, but the account compromise is the realistic starting point. For accounts that use 2FA, the whole purpose of the second factor was to stop exactly that case.
How to check if you're exposed
For a self-hosted instance, find your running version. If you deploy from the project's git repository, check the checked out tag:
git -C /path/to/cryptpad describe --tags
If you run a container image, check the image tag you deployed:
docker ps --format "{{.Names}} {{.Image}}"
Anything older than 2025.3.0 is in the affected range. If you use a hosted CryptPad service, ask the operator which version they run, or check their status page.
What to do now
- Upgrade every self-hosted CryptPad instance to 2025.3.0 or later, following the project's upgrade notes.
- Restart the service and confirm the new version is live.
- Ask users with 2FA enabled to reset their passwords if you suspect their credentials were exposed, since 2FA was not protecting them on the old versions.
- Review server logs for unexpected successful logins, especially from addresses your users do not normally use.
- Review who can reach the instance, and consider limiting access to a VPN or an allowed network range.
Why it matters
The weakness is listed as CWE-287, improper authentication, and CWE-284, improper access control. The code path that enforces the second factor depended on a loose check of how the request looked, not on the identity of the user making it. Anything that can change how the request looks may avoid the check.
This is a common shape for 2FA failures. The second factor is not one control but many small checks spread across request handlers, and a single missed case undoes the whole thing. When you review authentication code, look for checks that rely on formatting of paths or parameters.
The record's KEV flag is false, and no advisory I reviewed says it was exploited in the wild.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does this bypass work without the password?
The record says the attacker must have compromised the user's credentials. The flaw removes the second factor, not the first.
What is the fixed version?
CryptPad 2025.3.0, per the record and the project's GitHub advisory.
Sources
- Gold entry for CVE-2025-49591
- NVD record for CVE-2025-49591
- GitHub advisory GHSA-xq5x-wgcm-3p33
- Project commit with the fix
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan for the libraries in projects you manage.
Last reviewed: 18 October 2026.
