CVE-2025-62376 is a critical improper authentication vulnerability in the pwn.college DOJO education platform, affecting the /workspace endpoint prior to commit 467db0b9ea0d9a929dc89b41f6eb59f7cfc68bef. An attacker can exploit this by supplying arbitrary user IDs and passwords to access any active Windows VM without authorization, gaining full control over the target's Windows machine and associated Linux home directory. With a CVSS score of 9.5 (CRITICAL), this vulnerability has a low attack complexity and no user interaction required, leading to high confidentiality, integrity, and availability impacts. There are no known public exploits, Metasploit modules, or Nuclei templates, and it is not currently on the CISA KEV catalog or Hot List, nor has it garnered significant community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| Pwncollege | Dojo | < 467db0b9ea0d9a929dc89b41f6eb59f7cfc68befCNA affected |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.