CVE-2025-12870 aEnrich｜eHRD - Authentication Abuse

What is CVE-2025-12870?

CVE-2025-12870 is a critical authentication bypass vulnerability in aEnrich a+HRD, published on 12 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The a+HRD developed by aEnrich has an Authentication Abuse vulnerability, allowing unauthenticated remote attackers to send crafted packets to obtain administrator access tokens and use them to access the system with elevated privileges.

Weakness: CWE-1390

Which versions are affected by CVE-2025-12870?

It affects 1 product.

Products include Aenrich A\+hrd.

How do I fix CVE-2025-12870?

No fix has been published for CVE-2025-12870 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2025-12870 being exploited?

There is no known exploitation of CVE-2025-12870 in the wild and no public exploit code.

Other vulnerabilities in aEnrich a+HRD

• CVE-2025-0585 aEnrich Technology a+HRD - SQL Injection Critical 9.8
• CVE-2023-20852 aEnrich a+HRD - Deserialization of Untrusted Data Critical 9.8
• CVE-2023-20853 aEnrich a+HRD - Deserialization of Untrusted Data Critical 9.8
• CVE-2022-39039 aEnrich a+HRD - Server-Side Request Forgery (SSRF) Critical 9.8
• CVE-2022-39041 aEnrich a+HRD - SQL Injection Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-4765-m9wv-v7gx.