CVE-2025-68663 Outline has a suspended user authentication bypass via WebSocket connections
Suspended users can bypass authentication to maintain WebSocket connections and receive sensitive operational updates in Outline.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-68663?
CVE-2025-68663 is a medium-severity authentication bypass vulnerability in outline, published on 11 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Outline is a service that allows for collaborative documentation. Prior to 1.1.0, a vulnerability was found in Outline's WebSocket authentication mechanism that allows suspended users to maintain or establish real-time WebSocket connections and continue receiving sensitive operational updates after their account has been suspended. This vulnerability is fixed in 1.1.0.
Weakness: CWE-287
Which versions are affected by CVE-2025-68663?
It affects 1 product.
Products include Getoutline Outline.
How do I fix CVE-2025-68663?
No fix has been published for CVE-2025-68663 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-68663 being exploited?
There is no known exploitation of CVE-2025-68663 in the wild and no public exploit code.
Other vulnerabilities in outline
- CVE-2026-33640 Outline has a rate limit bypass that allows brute force of email login OTP
- CVE-2024-37829 Auth bypass in n/a
- CVE-2023-54331 Outline 1.6.0 - Unquoted Service Path
- CVE-2023-3532 Cross-site Scripting (XSS) - Stored in outline/outline
- CVE-2026-24901 Outline's IDOR allows unauthorized viewing and seizing of private deleted drafts
Sources
Also known as GHSA-mx2c-3g2x-5m9m.