CVE-2025-69246 is a critical flaw (CVSS 9.8) in Raytha CMS. It has no brute force protection, so an attacker can send many automated login attempts without triggering lockout, throttling or other challenges. The issue was fixed in version 1.4.6, so upgrade to it or later.
What's affected
- Raytha CMS before 1.4.6.
- Fixed version: 1.4.6.
How to check if you're exposed
Read the Raytha version from the admin area or the deployment's release information. Anything below 1.4.6 is affected.
Check your web server or application logs for runs of failed login requests from one address or across many. Repeated attempts against the login path are the signal to look for.
What to do now
- Upgrade Raytha to 1.4.6 or later.
- Put a rate limit on the login route at your reverse proxy or web application firewall as an extra layer.
- Use long, unique passwords for administrator accounts, and review those accounts.
- Restrict the admin area to known addresses where practical.
- Review logs for failed login bursts and treat any success after many failures as suspicious.
Pair lockout with monitoring. A burst of failed logins is useful evidence, and an alert on it costs little. If you front the CMS with a proxy or firewall, a rate limit on the login route gives you protection on versions you have not yet upgraded, and covers any similar gap in other apps behind it.
Why it matters
The weakness is CWE-307, improper restriction of excessive authentication attempts. Without a limit, the only thing between an attacker and an account is how guessable the password is, and attackers can try thousands of passwords cheaply.
This is a design gap rather than a coding error, and it is common. A lockout, a delay, or a challenge after a few failures makes guessing impractical. The record does not list this CVE as exploited in the wild.
Quick check
Does CVE-2025-69246 need a valid account?
No. The attacker tries logins without one. Version 1.4.6 fixes the missing protection.
Sources
Last reviewed: 19 October 2026.
