CVE-2025-43863 affects vantage6, an open source framework for federated learning and privacy enhancing technologies. The change password route does not limit failed attempts, so someone holding an authenticated session can guess the current password. The advisory fixes it in version 4.11. Upgrade, and treat any stolen session as a serious event.
What's affected
- Product: vantage6, distributed on PyPI as
vantage6. - Affected: versions before 4.11.
- Fixed version: 4.11, per the project's GitHub advisory GHSA-j6g5-p62x-58hw.
- Preconditions: the attacker needs an authenticated session first. The advisory itself rates the issue Low, while the NVD score listed in the record is 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Read both before you set your priority.
- Workarounds: the advisory lists none.
How to check if you're exposed
# in the environment that runs the server or the node
pip show vantage6
pip list 2>/dev/null | grep -i vantage6
# in a requirements or lock file
grep -i vantage6 requirements*.txt poetry.lock Pipfile.lock 2>/dev/null
If the version printed is lower than 4.11, you are in the affected range. If you run vantage6 from container images, check the image tag against the 4.11 release in the project repository, and read the advisory page for current guidance.
To see which of your projects pull in an affected component, run the free in-browser dependency scan at gold.safeguard.sh/scan. Reachability analysis then helps you separate libraries that your code actually calls from ones that only sit in a lockfile.
What to do now
- Upgrade vantage6 to 4.11 or later on every server and node that runs it, then restart the services.
- Review who can sign in. Remove accounts that are no longer needed and confirm that each remaining account has its own credentials.
- Check server logs for repeated password change failures from one account. The advisory does not describe log formats, so look at your own authentication and API logs.
- If you suspect a session was taken over, reset the affected passwords and revoke active sessions.
- Add rate limiting at your reverse proxy or API gateway for the change password route until every instance is upgraded.
Why it matters
The weakness is CWE-307, improper restriction of excessive authentication attempts. A password check that answers wrong or right with no delay and no lockout is a guessing oracle. The change password route asks for the current password, which makes it a second login form in practice, and one that is easy to forget when you protect the main sign in page.
The attacker still needs a session before this matters, which is why the project rated it Low. A session can be borrowed from an unlocked laptop, a shared browser or a leaked token. Once the password is known, the attacker is no longer tied to that session. The record does not mark this CVE as exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities list.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does the attacker need to be logged in?
Yes. The advisory says the attacker must first have access to an authenticated session, then calls the change password route repeatedly.
Which version fixes it?
Version 4.11, according to the project's GitHub advisory.
Sources
Last reviewed: 18 October 2026.
