CVE-2025-34114 OpenBlow Missing Critical Security Headers
Missing HTTP security headers in OpenBlow allow XSS, clickjacking, and referer leakage, requiring administrators to configure proper response headers.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-34114?
CVE-2025-34114 is a high-severity vulnerability in Laser Romae s.r.l. OpenBlow, published on 25 Jul 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A client-side security misconfiguration vulnerability exists in OpenBlow whistleblowing platform across multiple versions and default deployments, due to the absence of critical HTTP response headers including Content-Security-Policy, Referrer-Policy, Permissions-Policy, Cross-Origin-Embedder-Policy, and Cross-Origin-Resource-Policy. This omission weakens browser-level defenses and exposes users to cross-site scripting (XSS), clickjacking, and referer leakage. Although some instances attempt to enforce CSP via HTML <meta> tags, this method is ineffective, as modern browsers rely on header-based enforcement to reliably block inline scripts and untrusted resources.
Which versions are affected by CVE-2025-34114?
How do I fix CVE-2025-34114?
No fix has been published for CVE-2025-34114 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-34114 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-34114 exists.
Sources
Also known as GHSA-39mx-wj78-mm9g.