CVE-2025-48372 Schule Has Insecure OTP Length, is Susceptible to Brute-Force Attacks
Attackers can brute-force short 4-digit OTPs to bypass authentication and take over accounts in the Schule school management system.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-48372?
CVE-2025-48372 is a medium-severity vulnerability in schule111 Schule, published on 22 May 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Schule is open-source school management system software. The generateOTP() function generates a 4-digit numeric One-Time Password (OTP). Prior to version 1.0.1, even if a secure random number generator is used, the short length and limited range (1000–9999) results in only 9000 possible combinations. This small keyspace makes the OTP highly vulnerable to brute-force attacks, especially in the absence of strong rate-limiting or lockout mechanisms. Version 1.0.1 fixes the issue.
Weakness: CWE-521
Which versions are affected by CVE-2025-48372?
It affects 1 product.
Products include Schule111 Schule School Management System.
How do I fix CVE-2025-48372?
No fix has been published for CVE-2025-48372 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-48372 being exploited?
There is no known exploitation of CVE-2025-48372 in the wild and no public exploit code.
Other vulnerabilities in schule111 Schule
Sources
Also known as GHSA-6c48-67xx-vqgc.