CVE-2025-54955

Published August 3rd, 2025

View on NVD ↗

CVSS v3

8.1

HIGH

CVSS v2

N/A

Affected

PROJECTS

Description

OpenNebula Community Edition (CE) before 7.0.0 and Enterprise Edition (EE) before 6.10.3 have a critical FireEdge race condition that can lead to full account takeover. By exploiting this, an unauthenticated attacker can obtain a valid JSON Web Token (JWT) belonging to a legitimate user without knowledge of their credentials.

OpenNebula/one

The open source Cloud & Edge Computing Platform bringing real freedom to your Enterprise Cloud 🚀

GitHub

1.7K

Stolichnayer/OpenNebula-Account-Takeover

OpenNebula contains a Race Condition vulnerability in the login process, allowing attackers to brute-force login and steal a legitimate user’s JSON Web Token (JWT), leading to Account Takeover.

GitHub