CVE-2025-27416

Scratch-Coding-Hut.github.io is the website for Coding Hut. The website as of 28 February 2025 contained a sign in with scratch username and password form. Any user who used the sign in page would be susceptible to any other user signing into their account. As of time of publication, a fix is not available but work on a fix is underway. As a workaround, users should avoid signing in.

CVSS

No CVSS.

References

Link	Resource
https://github.com/Scratch-Coding-Hut/Scratch-Coding-Hut.github.io/issues/3
https://github.com/Scratch-Coding-Hut/Scratch-Coding-Hut.github.io/security/advisories/GHSA-xx32-r9wr-whff

Configurations

No configuration.

History

15 Apr 2026, 00:35

Type	Values Removed	Values Added
Summary		(es) Scratch-Coding-Hut.github.io es el sitio web de Coding Hut. El 28 de febrero de 2025, el sitio web contenía un formulario de inicio de sesión con nombre de usuario y contraseña de Scratch. Cualquier usuario que utilizara la página de inicio de sesión podría verse expuesto a que cualquier otro usuario iniciara sesión en su cuenta. Al momento de la publicación, no había una solución disponible, pero se estaba trabajando en una. Como workaround, los usuarios deberían evitar iniciar sesión.

01 Mar 2025, 01:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-03-01 01:15

Updated : 2026-06-17 09:03

NVD link : CVE-2025-27416

Mitre link : CVE-2025-27416

CVE.ORG link : CVE-2025-27416

JSON object : View

Products Affected

No product.

CWE

CWE-287

Improper Authentication

{"id": "CVE-2025-27416", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-27416", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-03-04T19:18:19.172509Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "UNREPORTED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "Scratch-Coding-Hut", "product": "Scratch-Coding-Hut.github.io", "versions": [{"status": "affected", "version": "<= 2025-02-28"}]}]}], "published": "2025-03-01T01:15:28.857", "references": [{"url": "https://github.com/Scratch-Coding-Hut/Scratch-Coding-Hut.github.io/issues/3", "source": "security-advisories@github.com"}, {"url": "https://github.com/Scratch-Coding-Hut/Scratch-Coding-Hut.github.io/security/advisories/GHSA-xx32-r9wr-whff", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "Scratch-Coding-Hut.github.io is the website for Coding Hut. The website as of 28 February 2025 contained a sign in with scratch username and password form. Any user who used the sign in page would be susceptible to any other user signing into their account. As of time of publication, a fix is not available but work on a fix is underway. As a workaround, users should avoid signing in."}, {"lang": "es", "value": "Scratch-Coding-Hut.github.io es el sitio web de Coding Hut. El 28 de febrero de 2025, el sitio web conten\u00eda un formulario de inicio de sesi\u00f3n con nombre de usuario y contrase\u00f1a de Scratch. Cualquier usuario que utilizara la p\u00e1gina de inicio de sesi\u00f3n podr\u00eda verse expuesto a que cualquier otro usuario iniciara sesi\u00f3n en su cuenta. Al momento de la publicaci\u00f3n, no hab\u00eda una soluci\u00f3n disponible, pero se estaba trabajando en una. Como workaround, los usuarios deber\u00edan evitar iniciar sesi\u00f3n."}], "lastModified": "2026-06-17T09:03:32.770", "sourceIdentifier": "security-advisories@github.com"}