CVE-2025-30035 Lack of API authentication allowing session generation for any user
Attackers can bypass authentication and take over any user account by supplying only a username, gaining full system access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-30035?
CVE-2025-30035 is a critical authentication bypass vulnerability in CGM CLININET, published on 2 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The vulnerability enables an attacker to fully bypass authentication in CGM CLININET and gain access to any active user account by supplying only the username, without requiring a password or any other credentials. Obtaining a session ID is sufficient for session takeover and grants access to the system with the privileges of the targeted user.
Weakness: CWE-306
Which versions are affected by CVE-2025-30035?
How do I fix CVE-2025-30035?
No fix has been published for CVE-2025-30035 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-30035 being exploited?
There is no known exploitation of CVE-2025-30035 in the wild and no public exploit code.
Sources
Also known as GHSA-v3x9-33c3-3v3m.