CVE-2025-34413 Legality WHISTLEBLOWING Missing Critical HTTP Security Headers
The application fails to emit critical HTTP security headers by default, weakening browser defenses against client-side attacks like XSS and clickjacking.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-34413?
CVE-2025-34413 is a high-severity vulnerability in DigitalPA S.r.l. Legality WHISTLEBLOWING, published on 9 Dec 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Legality WHISTLEBLOWING by DigitalPA contains a protection mechanism failure in which critical HTTP security headers are not emitted by default. Affected deployments omit Content-Security-Policy, Referrer-Policy, Permissions-Policy, Cross-Origin-Embedder-Policy, Cross-Origin-Opener-Policy, and Cross-Origin-Resource-Policy (with CSP delivered via HTML meta elements being inadequate). The absence of these headers weakens browser-side defenses and increases exposure to client-side attacks such as cross-site scripting, clickjacking, referer leakage, and cross-origin data disclosure.
Weakness: CWE-693
Which versions are affected by CVE-2025-34413?
How do I fix CVE-2025-34413?
No fix has been published for CVE-2025-34413 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-34413 being exploited?
There is no known exploitation of CVE-2025-34413 in the wild and no public exploit code.
Sources
Also known as GHSA-r4xg-7r26-r275.