CVE-2025-59683 is a high severity (CVSS 8.2) improper access control flaw in the Secure Scheduler for Exchange service of Pexip Infinity 15.0 through 38.0. It can expose data and exhaust resources. Upgrade to 38.1. The sections below cover who is affected, how to check, and what to do now.
What's affected
Per the record, Pexip Infinity 15.0 through 38.0 is affected, and the fix is in 38.1. The problem is in the Secure Scheduler for Exchange service when used with Office 365 Legacy Exchange Tokens.
The record points to the Pexip security bulletins page for details. Installations that do not use the Secure Scheduler for Exchange with legacy tokens may not be exposed, but confirm that with Pexip's bulletin.
How to check if you're exposed
In the Pexip Infinity management interface, check the software version on the Management Node and on each conferencing node. Then see whether you use the Secure Scheduler for Exchange integration, and whether it is configured with Office 365 legacy Exchange tokens.
If both are true and the version is between 15.0 and 38.0, you are in the affected group.
What to do now
- Check the Infinity version on every node.
- Upgrade to 38.1 or later, following Pexip's upgrade guidance.
- Review whether the Secure Scheduler for Exchange integration is in use and still needed.
- Migrate away from Office 365 legacy Exchange tokens if you still rely on them.
- Check resource usage and logs on the scheduler service for unusual spikes.
Why it matters
The record maps this to CWE-863, incorrect authorization. Per the description, the service does not enforce access properly when used with legacy tokens, so a remote attacker can read potentially sensitive data and consume resources excessively, leading to denial of service.
The vector shows network access with no privileges and no interaction, low confidentiality impact, no integrity impact and high availability impact. That is why the headline risk is service disruption of a video conferencing platform. It is not on the CISA KEV list.
Authorization flaws are different from authentication flaws. The user may be properly logged in, yet the application fails to check whether that user is allowed to perform the specific action. These bugs are common in APIs because every endpoint has to repeat the check, and one missing check is enough.
The most useful test is to try each privileged action as an ordinary user and as an anonymous one, and confirm the server refuses both. Automated tests that do this for every route catch the regression the next time someone adds an endpoint.
A dependency scan will not see this one, because it concerns a product or service rather than a package in your code. The practical step is an asset inventory that records which of these products you run, which version, and who owns it. You can look up the record for this CVE in the Safeguard Gold directory and use the free scan at gold.safeguard.sh/scan for the software you build yourself.
Quick check
Which version fixes CVE-2025-59683?
Pexip Infinity 38.1, per the record.
Who is affected?
Deployments of versions 15.0 through 38.0 using the Secure Scheduler for Exchange service with Office 365 legacy Exchange tokens.
Sources
- Pexip security bulletins (listed in the record)
- NVD record data
Last reviewed: 18 October 2026.
