Stolichnayer/OpenNebula-Account-Takeover

Stolichnayer/OpenNebula-Account-Takeover

GitHubGitHub
GitHubgithub.com
Releases0
Stars1
OpenNebula contains a Race Condition vulnerability in the login process, allowing attackers to brute-force login and steal a legitimate user’s JSON Web Token (JWT), leading to Account Takeover.
Log in to subscribe

CVE History

CVEPublishedCVSS v3CVSS v2
CVE-2025-54955↗
8.1 HIGH—

OpenNebula Community Edition (CE) before 7.0.0 and Enterprise Edition (EE) before 6.10.3 have a critical FireEdge race condition that can lead to full account takeover. By exploiting this, an unauthenticated attacker can obtain a valid JSON Web Token (JWT) belonging to a legitimate user without knowledge of their credentials.