CVE-2025-0744: Thesamur Embedai Auth Bypass Vulnerability

CVE-2025-0744 Overview

CVE-2025-0744 is an Improper Access Control vulnerability [CWE-284] affecting EmbedAI version 2.1 and earlier from Thesamur. An authenticated attacker can modify their subscription plan without payment by sending a crafted POST request to the /demos/embedai/pmt_cash_on_delivery/pay endpoint. The flaw stems from missing server-side authorization checks on payment parameters submitted by the client. Successful exploitation results in integrity impact by allowing users to gain paid subscription tiers without valid billing. The vulnerability requires only low-privileged authenticated access and no user interaction, making it accessible to any registered account holder on the affected platform.

Critical Impact
Authenticated users can bypass payment controls and upgrade subscription plans without paying, causing direct financial loss to the service operator.

Affected Products

Thesamur EmbedAI 2.1
Thesamur EmbedAI versions prior to 2.1
EmbedAI /demos/embedai/pmt_cash_on_delivery/pay payment endpoint

Discovery Timeline

2025-01-30 - CVE-2025-0744 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-0744

Vulnerability Analysis

CVE-2025-0744 is a business logic and access control flaw in EmbedAI's payment workflow. The /demos/embedai/pmt_cash_on_delivery/pay endpoint accepts subscription and pricing parameters from the client without validating them against server-side authoritative data. An authenticated user can submit a POST request that alters plan identifiers or price values, and the application processes the change as a legitimate purchase. The endpoint does not verify whether payment was actually completed before applying the plan upgrade.

The vulnerability affects only the integrity of subscription state. Confidentiality and availability are not directly impacted. However, repeated abuse can cause measurable revenue loss and skew billing records used for downstream reporting.

Root Cause

The root cause is missing authorization and server-side validation on payment state transitions. The application trusts client-supplied parameters to determine subscription entitlement rather than validating them against a signed order token or a verified payment provider response. This matches the [CWE-284] Improper Access Control pattern, where the resource (a paid subscription plan) is granted without enforcing the access policy (proof of payment).

Attack Vector

Exploitation requires an authenticated account on the affected EmbedAI instance. The attacker intercepts or crafts a POST request to /demos/embedai/pmt_cash_on_delivery/pay and manipulates parameters that control the plan tier or price. Because the request is delivered over the network with low complexity and without user interaction, any account holder with basic HTTP tooling can reproduce the attack. See the INCIBE Security Notice for advisory details.

No verified public proof-of-concept is available. The vulnerability manifests in the payment handler's failure to validate plan and payment status server-side before granting entitlements.

Detection Methods for CVE-2025-0744

Indicators of Compromise

POST requests to /demos/embedai/pmt_cash_on_delivery/pay from authenticated users followed immediately by a subscription tier upgrade in application state.
Discrepancies between application subscription records and payment gateway or cash-on-delivery ledger entries.
Multiple plan changes from a single user account within short time windows without corresponding payment confirmations.

Detection Strategies

Correlate application access logs for the pmt_cash_on_delivery/pay endpoint with billing system transaction records to surface unmatched upgrades.
Instrument the payment handler to log all inbound parameters and compare submitted plan identifiers against server-side price catalogs.
Alert on any HTTP 200 responses from the payment endpoint that are not preceded by a valid order creation event.

Monitoring Recommendations

Enable verbose logging on payment and subscription state-change endpoints and forward logs to a centralized SIEM.
Monitor for parameter tampering patterns such as negative price values, zero-cost plan IDs, or premium plan identifiers submitted by free-tier accounts.
Track subscription tier distribution over time and investigate anomalous shifts toward paid tiers without matching revenue growth.

How to Mitigate CVE-2025-0744

Immediate Actions Required

Upgrade EmbedAI to a version later than 2.1 once the vendor publishes a fix.
Audit subscription records against payment gateway transactions and revoke plans that lack corresponding payments.
Restrict access to the /demos/embedai/pmt_cash_on_delivery/pay endpoint at the reverse proxy layer while a patched version is being deployed.

Patch Information

No vendor patch or advisory URL is listed in the enriched CVE data. Refer to the INCIBE Security Notice and monitor the Thesamur EmbedAI project for updates. Users of EmbedAI 2.1 and earlier should treat all installations as vulnerable until an official fixed release is confirmed.

Workarounds

Implement a reverse-proxy or Web Application Firewall (WAF) rule that validates the plan and price parameters submitted to the payment endpoint against an allowlist.
Enforce server-side validation by mapping subscription plans to authoritative price data and rejecting requests that mismatch.
Require a signed order token issued at checkout initiation and validate it at payment completion to prevent parameter tampering.
Temporarily disable the cash-on-delivery payment flow if it is not business-critical until the vulnerability is patched.

bash

# Example nginx rule to block tampered plan parameters at the edge
location /demos/embedai/pmt_cash_on_delivery/pay {
    if ($request_method = POST) {
        # Block requests where plan_id or price is client-supplied outside allowed set
        if ($arg_plan_id !~ ^(free|basic|pro)$) { return 403; }
    }
    proxy_pass http://embedai_backend;
}