CVE-2025-1909 BuddyBoss Platform Pro <= 2.7.01 - Authentication Bypass via Apple OAuth provider

What is CVE-2025-1909?

CVE-2025-1909 is a critical authentication bypass vulnerability in BuddyBoss Platform Pro, published on 5 May 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The BuddyBoss Platform Pro plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.7.01. This is due to insufficient verification on the user being supplied during the Apple OAuth authenticate request through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email.

Weakness: CWE-288

Which versions are affected by CVE-2025-1909?

It affects 1 product.

Products include Buddyboss Buddyboss Platform.

How do I fix CVE-2025-1909?

No fix has been published for CVE-2025-1909 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2025-1909 being exploited?

There is no known exploitation of CVE-2025-1909 in the wild and no public exploit code.

Other vulnerabilities in BuddyBoss Platform Pro

• CVE-2024-13858 Cross-site scripting in BuddyBoss Platform Medium 6.4
• CVE-2024-13859 Cross-site scripting in BuddyBoss Platform Medium 6.4
• CVE-2024-13860 BuddyBoss Platform <= 2.8.50 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'bbp_topic_title' Medium 6.4
• CVE-2024-13402 BuddyBoss Platform <= 2.7.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'link_title' Medium 6.4
• CVE-2024-4886 BuddyBoss Platform < 2.6.0 - Subscriber+ Comment on Private Post via IDOR Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-2xjw-5437-xj2x.