{"id":"CVE-2025-66001","revision":"158832a80afc4cb29b5a70b88be49233","records":[{"revision":"158832a80afc4cb29b5a70b88be49233","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-66001","aliases":[],"title":"NeuVector OpenID Connect is vulnerable to man-in-the-middle (MITM)","description":"NeuVector supports login authentication through OpenID Connect. However, the TLS verification (which verifies the remote server's authenticity and integrity) for OpenID Connect is not enforced by default. As a result this may expose the system to man-in-the-middle (MITM) attacks.","state":0,"publishedAt":"2026-01-08T10:23:18.934+00:00","modifiedAt":"2026-01-08T14:56:07.901+00:00","affected":[{"ecosystem":"Vendor product","name":"github.com/neuvector/neuvector","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageName\": \"github.com/neuvector/neuvector\",\n                    \"product\": \"neuvector\",\n                    \"vendor\": \"SUSE\",\n                    \"versions\": [\n                        {\n                            \"lessThan\": \"5.4.8\",\n                            \"status\": \"affected\",\n                            \"version\": \"5.3.0\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","score":8.8,"severity":"HIGH"}],"references":["https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-66001","https://github.com/neuvector/neuvector/security/advisories/GHSA-4jj9-cgqc-x9h5"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-66001","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-66001","identifiers":["CVE-2025-66001"]},"retained":false,"historicalAffected":[]}],"coverage":[]}