CVE-2025-5512 is a high severity improper authentication flaw in quequnlong shiyi-blog up to version 1.2.1. The /api/sys/user/verifyPassword endpoint of the administrator backend can be manipulated, with no login needed. The reporter says the maintainer did not respond, and no fixed version is named.
What's affected
- Product: quequnlong shiyi-blog.
- Affected: up to and including 1.2.1.
- Component:
/api/sys/user/verifyPassword/in the administrator backend. - Fixed version: none is named. The reporter says the vendor did not respond.
- Authentication: the vector shows no privileges required.
The reporter's write-up, listed in the record, describes the issue as a way around the backend screen lock. Read that page directly for detail, since this article does not repeat technique.
The same project has CVE-2025-5509 and CVE-2025-5510 published the same day.
How to check if you're exposed
Check which shiyi-blog version you run and how the administrator backend is exposed.
- Is the backend reachable from the internet? If it is, move it behind a VPN or an IP allowlist at once.
- Review the administrator accounts and recent logins. Remove accounts you do not recognize.
- Check logs for requests to the verifyPassword path from unfamiliar addresses.
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan that checks a manifest or lockfile against known vulnerabilities, and the Gold directory lists affected packages for each CVE.
What to do now
- Confirm the version and take the backend off the public internet.
- Put the administrator interface behind a VPN, an authenticating proxy or an IP allowlist.
- Review administrator accounts and sessions, and change passwords if you see signs of unauthorized use.
- Check the repository for a fix newer than 1.2.1. None is named in the record.
- If the project stays unmaintained, plan a move to a maintained blog platform.
Why it matters
Improper authentication means a check that should prove identity can be satisfied by something other than valid credentials. In this case the record points at a lock or password verification step in the backend. If the server trusts the result of a check that the client can influence, the check offers no protection.
Because the flaw needs no account, network access is the main control available while there is no patch. An administrator interface should never be open to the public internet when it can be avoided. The CVE is not on the CISA KEV list.
The weakness is classed as CWE-287 (Improper Authentication). Severity in the CVE record: high, CVSS 7.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).
Quick check
Does this need a login?
The vector shows no privileges required, so it can be attempted without an account.
What should I do first?
Take the administrator backend off the public internet, then look for a maintained fix or alternative.
Sources
- Researcher write-up on GitHub (listed in the CVE record, not fetched)
- VulDB entry 310926 (listed in the CVE record, not fetched)
Last reviewed: 18 October 2026.
