CVE-2025-66270 Auth bypass in KDE Connect protocol
Attackers can bypass device authentication by exploiting a lack of correlation between device IDs in KDE Connect protocol packets.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-66270?
CVE-2025-66270 is a medium-severity authentication bypass vulnerability in KDE Connect protocol, published on 5 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The KDE Connect protocol 8 before 2025-11-28 does not correlate device IDs across two packets. This affects KDE Connect before 25.12 on desktop, KDE Connect before 0.5.4 on iOS, KDE Connect before 1.34.4 on Android, GSConnect before 68, and Valent before 1.0.0.alpha.49.
Weakness: CWE-290
Which versions are affected by CVE-2025-66270?
Linux distribution packages (1)
kdeconnect-kde openSUSE:Tumbleweed | All versions | 25.11.90-1.1 |
How do I fix CVE-2025-66270?
Upgrade to a fixed version.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-66270 being exploited?
There is no known exploitation of CVE-2025-66270 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2025-66270, DSA-6063-1, DSA-6066-1, GHSA-xcg9-fw4f-9chv, UBUNTU-CVE-2025-66270, USN-7905-1 and 1 more.