CVE-2025-44040 Auth bypass in n/a
An attacker could potentially escalate privileges in OrangeHRM via loose equality checks in authentication logic, though the vendor disputes exploitability.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-44040?
CVE-2025-44040 is a high-severity authentication bypass vulnerability in n/a, published on 21 May 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
An issue in OrangeHRM v.5.7 allows an attacker to escalate privileges via UserService.php and the checkForOldHash function. Authentication decisions may be made via PHP loose-equality comparisons if a specific MD5 value is present in the credential store. NOTE: this is disputed by the Supplier because an adversary has no way to place the specific MD5 value into the credential store (unless they already have full privileges) and because the specific MD5 value would not realistically be present otherwise.
Weakness: CWE-269
Which versions are affected by CVE-2025-44040?
It affects 1 product.
Products include Orangehrm Orangehrm.
How do I fix CVE-2025-44040?
No fix has been published for CVE-2025-44040 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-44040 being exploited?
There is no known exploitation of CVE-2025-44040 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2007-1193 Other in n/a
- CVE-2025-66224 OrangeHRM is Vulnerable to Code Execution Through Arbitrary File Write from Sendmail Parameter Injection
- CVE-2019-12839 Command injection in n/a
- CVE-2025-66225 OrangeHRM is Vulnerable to Account Takeover Through Unvalidated Username in Password Reset Workflow
- CVE-2025-66289 OrangeHRM is Vulnerable to Persistent Session Access Due to Missing Invalidation After User Disable and Password Change
Sources
Also known as GHSA-vj38-xwp2-x5gc.