CVE-2025-7897 harry0703 MoneyPrinterTurbo API Endpoint base.py verify_token missing authentication
Attackers can bypass authentication on the MoneyPrinterTurbo API endpoint due to a missing token verification check, allowing unauthorized access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-7897?
CVE-2025-7897 is a medium-severity missing authorization vulnerability in harry0703 MoneyPrinterTurbo, published on 20 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability was found in harry0703 MoneyPrinterTurbo up to 1.2.6 and classified as critical. Affected by this issue is the function verify_token of the file app/controllers/base.py of the component API Endpoint. The manipulation leads to missing authentication. The attack may be launched remotely.
Which versions are affected by CVE-2025-7897?
It affects 1 product.
Products include Harry0703 Moneyprinterturbo.
How do I fix CVE-2025-7897?
No fix has been published for CVE-2025-7897 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-7897 being exploited?
There is no known exploitation of CVE-2025-7897 in the wild and no public exploit code.
Other vulnerabilities in harry0703 MoneyPrinterTurbo
- CVE-2025-10472 harry0703 MoneyPrinterTurbo URL video.py stream_video path traversal
- CVE-2025-49089 Path traversal in n/a
- CVE-2025-11607 harry0703 MoneyPrinterTurbo API Endpoint music.py upload_music path traversal
- CVE-2025-7895 harry0703 MoneyPrinterTurbo File Extension video.py upload_bgm_file unrestricted upload
- CVE-2025-7896 harry0703 MoneyPrinterTurbo video.py delete_video path traversal
Sources
Also known as GHSA-h842-f758-5xgc.