CVE-2025-62294 Predictable Generation of Password Recovery Token

What is CVE-2025-62294?

CVE-2025-62294 is a high-severity vulnerability in SOPlanning, published on 20 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

SOPlanning is vulnerable to Predictable Generation of Password Recovery Token. Due to weak mechanism of generating recovery tokens, a malicious attacker is able to brute-force all possible values and takeover any account in reasonable amount of time.

This issue was fixed in version 1.55.

Weakness: CWE-340

Which versions are affected by CVE-2025-62294?

It affects 1 product.

Products include Soplanning Soplanning.

How do I fix CVE-2025-62294?

No fix has been published for CVE-2025-62294 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-62294 being exploited?

There is no known exploitation of CVE-2025-62294 in the wild and no public exploit code.

Other vulnerabilities in SOPlanning

• CVE-2024-27115 Remote Code Execution through File Upload in SOPlanning before 1.52.02 Critical 10.0
• CVE-2024-57169 File upload in n/a Critical 9.8
• CVE-2024-9574 SQL Injection vulnerability in SOPlanning Critical 9.8
• CVE-2020-13963 Hardcoded credentials in n/a Critical 9.8
• CVE-2014-8673 SQL injection in n/a Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-vm86-vfwq-9qvc.