{"id":"CVE-2025-61926","revision":null,"records":[{"revision":"4df33af9f8b14fb6b6a2d5c9784a6cf0","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-61926","aliases":[],"title":"Allstar Reviewbot has Authentication Bypass via Hard-coded Webhook Secret","description":"Allstar is a GitHub App to set and enforce security policies. In versions prior to 4.5, a vulnerability in Allstar’s Reviewbot component caused inbound webhook requests to be validated against a hard-coded, shared secret. The value used for the secret token was compiled into the Allstar binary and could not be configured at runtime. In practice, this meant that every deployment using Reviewbot would validate requests with the same secret unless the operator modified source code and rebuilt the component - an expectation that is not documented and is easy to miss. All Allstar releases prior to v4.5 that include the Reviewbot code path are affected. Deployments on v4.5 and later are not affected. Those who have not enabled or exposed the Reviewbot endpoint are not exposed to this issue.","state":0,"publishedAt":"2025-10-09T21:20:32.67+00:00","modifiedAt":"2025-10-16T18:13:02.504+00:00","affected":[{"ecosystem":"Vendor product","name":"allstar","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"ossf\",\n                    \"product\": \"allstar\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 0.0.0-20250721181116-e004ecb540d6\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U","score":4.6,"severity":"MEDIUM"}],"references":["https://github.com/ossf/allstar/security/advisories/GHSA-33f4-mjch-7fpr","https://github.com/ossf/allstar/pull/713","https://github.com/ossf/allstar/commit/e004ecb540d63ca6f5b1689b41af6c0040a82c73","https://github.com/ossf/allstar/blob/294ae985cc2facd0918e8d820e4196021aa0b914/pkg/reviewbot/reviewbot.go#L59"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-61926","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-61926","identifiers":["CVE-2025-61926"]},"retained":false,"historicalAffected":[]},{"revision":"df4d6a2688de479ea3067882d9bc281f","observedAt":"2026-11-11T04:29:51.737+00:00","statement":{"source":"euvd","id":"EUVD-2025-33544","aliases":["CVE-2025-61926","GHSA-33f4-mjch-7fpr"],"title":"Allstar is a GitHub App to set and enforce security policies. In versions prior to 4.5, a vulnerability in Allstar’s Reviewbot component caused inbound webhook requests to be validated against a hard-coded, shared secret. The value used for…","description":"Allstar is a GitHub App to set and enforce security policies. In versions prior to 4.5, a vulnerability in Allstar’s Reviewbot component caused inbound webhook requests to be validated against a hard-coded, shared secret. The value used for the secret token was compiled into the Allstar binary and could not be configured at runtime. In practice, this meant that every deployment using Reviewbot would validate requests with the same secret unless the operator modified source code and rebuilt the component - an expectation that is not documented and is easy to miss. All Allstar releases prior to v4.5 that include the Reviewbot code path are affected. Deployments on v4.5 and later are not affected. Those who have not enabled or exposed the Reviewbot endpoint are not exposed to this issue.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U","score":4.6,"severity":null}],"references":["https://github.com/ossf/allstar/security/advisories/GHSA-33f4-mjch-7fpr","https://github.com/ossf/allstar/pull/713","https://github.com/ossf/allstar/commit/e004ecb540d63ca6f5b1689b41af6c0040a82c73","https://github.com/ossf/allstar/blob/294ae985cc2facd0918e8d820e4196021aa0b914/pkg/reviewbot/reviewbot.go#L59"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-33544","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Oct 9, 2025, 9:20:32 PM","dateUpdated":"Oct 16, 2025, 6:13:02 PM"},"relatedAdvisories":[{"id":"openSUSE-SU-2025:15666-1","title":"govulncheck-vulndb-0.0.20251023T162509-1.1 on GA media","vulnerabilityIds":["CVE-2024-58260","CVE-2024-58267","CVE-2025-23266","CVE-2025-23267","CVE-2025-54468","CVE-2025-55191","CVE-2025-59163","CVE-2025-59531","CVE-2025-59537","CVE-2025-59538","CVE-2025-59823","CVE-2025-59824","CVE-2025-59941","CVE-2025-59942","CVE-2025-59956","CVE-2025-61595","CVE-2025-61926"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-33544","identifiers":["EUVD-2025-33544","CVE-2025-61926","GHSA-33f4-mjch-7fpr"]},"retained":false,"historicalAffected":[]},{"revision":"35f7d92b1ebb4dad932b86be20da02c9","observedAt":"2026-10-25T03:17:27.277+00:00","statement":{"source":"nvd","id":"CVE-2025-61926","aliases":[],"title":"Allstar is a GitHub App to set and enforce security policies. In versions prior to 4.5, a vulnerability in Allstar’s Reviewbot component caused inbound webhook requests to be validated against a hard-coded, shared secret. The value used for…","description":"Allstar is a GitHub App to set and enforce security policies. In versions prior to 4.5, a vulnerability in Allstar’s Reviewbot component caused inbound webhook requests to be validated against a hard-coded, shared secret. The value used for the secret token was compiled into the Allstar binary and could not be configured at runtime. In practice, this meant that every deployment using Reviewbot would validate requests with the same secret unless the operator modified source code and rebuilt the component - an expectation that is not documented and is easy to miss. All Allstar releases prior to v4.5 that include the Reviewbot code path are affected. Deployments on v4.5 and later are not affected. Those who have not enabled or exposed the Reviewbot endpoint are not exposed to this issue.","state":0,"publishedAt":"2025-10-09T22:15:32.63+00:00","modifiedAt":"2026-10-08T13:10:00.2+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · security-advisories@github.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":4.6,"severity":"MEDIUM"}],"references":["https://github.com/ossf/allstar/blob/294ae985cc2facd0918e8d820e4196021aa0b914/pkg/reviewbot/reviewbot.go#L59","https://github.com/ossf/allstar/commit/e004ecb540d63ca6f5b1689b41af6c0040a82c73","https://github.com/ossf/allstar/pull/713","https://github.com/ossf/allstar/security/advisories/GHSA-33f4-mjch-7fpr"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-61926","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-453","CWE-798"],"productCriteria":[],"sourceDates":{"published":"2025-10-09T22:15:32.630","lastModified":"2026-10-08T13:10:00.200"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2025-61926","identifiers":["CVE-2025-61926"]},"retained":false,"historicalAffected":[]},{"revision":"13284afd264249759a061eaade6e926d","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-33f4-mjch-7fpr","aliases":["CVE-2025-61926","GO-2025-4018"],"title":"Allstar Reviewbot has Authentication Bypass via Hard-coded Webhook Secret","description":"A vulnerability in Allstar’s Reviewbot component caused inbound webhook requests to be validated against a hard-coded, shared secret:\n\nhttps://github.com/ossf/allstar/blob/294ae985cc2facd0918e8d820e4196021aa0b914/pkg/reviewbot/reviewbot.go#L59\n\nThe value used for the secret token was compiled into the Allstar binary and could not be configured at runtime. In practice, this meant that every deployment using Reviewbot would validate requests with the same secret unless the operator modified source code and rebuilt the component - an expectation that is not documented and is easy to miss. While Reviewbot is not commonly enabled in standard Allstar setups, we are issuing this advisory to reach any environments where it may have been deployed.\n\n## Affected Versions\n\nAll Allstar releases prior to v4.5 that include the Reviewbot code path are affected. Deployments on v4.5 and later are not affected. If you have not enabled or exposed the Reviewbot endpoint, this issue does not apply to your installation.\n\n## Impact\n\nIf the Reviewbot endpoint is deployed and reachable, an attacker can bypass authentication by crafting webhook requests that use the known, hard-coded secret. Because signature verification will succeed, Reviewbot would treat these requests as authentic when they should be rejected. Depending on the permissions and automations attached to your deployment, this could allow unauthorized triggering of review actions such as posting automated comments or reviews, influencing checks, or otherwise manipulating repository signals. The primary risk is to the integrity of repository workflows rather than confidentiality or availability, although secondary effects (e.g., noisy automation, misleading reviews, or workflow disruptions) are possible.\n\n## Exploitability\n\nExploiting this is straightforward and does not require an attacker to be authenticated. Anyone who can send requests to the Reviewbot webhook can reach the vulnerable code.","state":0,"publishedAt":"2025-10-10T22:53:42+00:00","modifiedAt":"2025-10-23T20:35:27+00:00","affected":[{"ecosystem":"Go","name":"github.com/ossf/allstar","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.0.0-20250721181116-e004ecb540d6"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/ossf/allstar/security/advisories/GHSA-33f4-mjch-7fpr","https://nvd.nist.gov/vuln/detail/CVE-2025-61926","https://github.com/ossf/allstar/pull/713","https://github.com/ossf/allstar/commit/e004ecb540d63ca6f5b1689b41af6c0040a82c73","https://github.com/ossf/allstar","https://github.com/ossf/allstar/blob/294ae985cc2facd0918e8d820e4196021aa0b914/pkg/reviewbot/reviewbot.go#L59","https://pkg.go.dev/vuln/GO-2025-4018"],"sourceUrl":"https://github.com/advisories/GHSA-33f4-mjch-7fpr","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-33f4-mjch-7fpr","identifiers":["GHSA-33f4-mjch-7fpr","CVE-2025-61926","GO-2025-4018"]},"retained":false,"historicalAffected":[]},{"revision":"e570a2a250f04a6686f600f2299926da","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2025-4018","aliases":["CVE-2025-61926","GHSA-33f4-mjch-7fpr"],"title":"Allstar Reviewbot has Authentication Bypass via Hard-coded Webhook Secret in github.com/ossf/allstar","description":"Allstar Reviewbot has Authentication Bypass via Hard-coded Webhook Secret in github.com/ossf/allstar","state":0,"publishedAt":"2025-10-23T16:25:09+00:00","modifiedAt":"2026-03-03T04:56:59.368065+00:00","affected":[{"ecosystem":"Go","name":"github.com/ossf/allstar","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.0.0-20250721181116-e004ecb540d6"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/ossf/allstar/security/advisories/GHSA-33f4-mjch-7fpr","https://nvd.nist.gov/vuln/detail/CVE-2025-61926","https://github.com/ossf/allstar/commit/e004ecb540d63ca6f5b1689b41af6c0040a82c73","https://github.com/ossf/allstar/pull/713","https://github.com/ossf/allstar/blob/294ae985cc2facd0918e8d820e4196021aa0b914/pkg/reviewbot/reviewbot.go#L59"],"sourceUrl":"https://osv.dev/vulnerability/GO-2025-4018","license":"OSV · upstream source license applies","key":"osv:GO-2025-4018","identifiers":["GO-2025-4018","CVE-2025-61926","GHSA-33f4-mjch-7fpr"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-11T09:26:00.1517867+00:00","complete":true,"records":1779,"lastAttemptAt":"2026-11-11T09:26:00.1517867+00:00","lastSuccessAt":"2026-11-11T09:26:00.3919657+00:00","error":null,"lastVerifiedAt":"2026-11-11T09:26:00.3919664+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-de3b77103708811b6494d2ff7c979037d73ae579742cd1649a5c765137ae5083-f19af5e22c13aa688d23829fe96c281d0deaf6cf2f8cee6748f54f5a479127b2","complete":true,"records":424021,"lastAttemptAt":"2026-11-11T09:25:54.6180937+00:00","lastSuccessAt":"2026-11-11T09:25:54.5258746+00:00","error":null,"lastVerifiedAt":"2026-11-11T09:25:54.6180937+00:00","snapshotPublishedAt":"2026-11-11T09:25:28+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-f3cfddba55ce40a0bbff5d425c207d59","complete":false,"records":13758,"lastAttemptAt":"2026-11-11T09:37:37.9804078+00:00","lastSuccessAt":"2026-11-11T09:37:37.974+00:00","error":"16 identifier lookups failed; latest failures include HTTP 403. Other identifiers were checked independently.","lastVerifiedAt":"2026-11-11T09:37:37.974+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13776,"expectedIdentifiers":13812,"failedIdentifiers":16},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-11T09:26:00.1517867+00:00","complete":true,"records":1097,"lastAttemptAt":"2026-11-11T09:26:00.1517867+00:00","lastSuccessAt":"2026-11-11T09:26:00.3927797+00:00","error":null,"lastVerifiedAt":"2026-11-11T09:26:00.3927799+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-304fa97221904da4b3dcd306fc4b8a4b","complete":true,"records":13752,"lastAttemptAt":"2026-11-11T09:26:01.4581358+00:00","lastSuccessAt":"2026-11-11T09:26:01.454+00:00","error":null,"lastVerifiedAt":"2026-11-11T09:26:01.454+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13812,"expectedIdentifiers":13812,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-3562b6c78fd1bd0f0b55daf66a0926ae24f65e462df7f6d928caad458fc696bf","complete":true,"records":9947,"lastAttemptAt":"2026-11-11T09:25:54.9948719+00:00","lastSuccessAt":"2026-11-11T04:27:43.6877707+00:00","error":null,"lastVerifiedAt":"2026-11-11T09:25:54.9948719+00:00","snapshotPublishedAt":"2026-11-11T03:32:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-456002455e0ab94bb92c95476d4e6d175c104cd594749982afd96c893728ecbc","complete":true,"records":2010,"lastAttemptAt":"2026-11-11T09:25:54.7785287+00:00","lastSuccessAt":"2026-11-11T02:36:58.1276999+00:00","error":null,"lastVerifiedAt":"2026-11-11T09:25:54.7785287+00:00","snapshotPublishedAt":"2026-11-11T01:17:51+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-2bc186fc4a8179fd66d765079d475b0b8e3af9f89b57dcc310e7773ded48b2cc","complete":true,"records":3088,"lastAttemptAt":"2026-11-11T09:26:00.1096189+00:00","lastSuccessAt":"2026-11-11T09:25:59.9234294+00:00","error":null,"lastVerifiedAt":"2026-11-11T09:26:00.1096189+00:00","snapshotPublishedAt":"2026-11-11T09:02:55+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-085e065fc9050ae18408f7e722c39653aeb186872334d7b3ec1fcafb7ed43d25","complete":true,"records":231665,"lastAttemptAt":"2026-11-11T09:25:54.8906223+00:00","lastSuccessAt":"2026-11-11T08:27:45.2700102+00:00","error":null,"lastVerifiedAt":"2026-11-11T09:25:54.8906223+00:00","snapshotPublishedAt":"2026-11-11T07:32:59+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}