CVE-2025-15105 Overview
CVE-2025-15105 affects Maxun versions up to 0.0.28. The flaw resides in the /server/src/routes/auth.ts file, where the api_key argument is tied to a hard-coded cryptographic key [CWE-798, CWE-320]. Attackers can manipulate the api_key parameter remotely to abuse the embedded secret. The public disclosure includes a proof-of-concept gist, and the vendor did not respond to disclosure attempts. Exploitation carries high complexity, limiting the practical attack surface, but the release of PoC material means defenders should treat affected deployments as exposed.
Critical Impact
A publicly disclosed hard-coded cryptographic key in Maxun's authentication route enables remote attackers to bypass cryptographic protections tied to the api_key parameter.
Affected Products
- Maxun maxun versions up to and including 0.0.28
- Component: getmaxun/maxun/server/src/routes/auth.ts
- Deployments exposing the Maxun API to untrusted networks
Discovery Timeline
- 2025-12-27 - CVE-2025-15105 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-15105
Vulnerability Analysis
Maxun is an open-source no-code web data extraction platform. The authentication route file server/src/routes/auth.ts contains a hard-coded cryptographic key used in operations involving the api_key argument. Because the secret is embedded in the source repository, any actor with access to the public codebase can extract it and produce or validate cryptographic material that the server treats as authentic.
The weakness is classified under [CWE-798] (Use of Hard-coded Credentials) and [CWE-320] (Key Management Errors). The upstream advisory notes exploitation is remote but high complexity, indicating that additional conditions must be met to weaponize the disclosed key against a live target.
Root Cause
The root cause is the storage of a static cryptographic key inside application source code rather than a runtime-provisioned secret store. Every deployment built from an unmodified release of Maxun 0.0.28 or earlier ships with the same key material, which eliminates the cryptographic uniqueness needed for the api_key flow to remain trustworthy.
Attack Vector
An attacker reaches the Maxun API over the network without authentication or user interaction. Using the disclosed key extracted from the public repository, the attacker manipulates the api_key argument to forge or validate tokens the server accepts. The published proof-of-concept on GitHub Gist documents the manipulation path. See the GitHub Gist PoC and the VulDB entry #338476 for full technical detail.
Detection Methods for CVE-2025-15105
Indicators of Compromise
- Unexpected authenticated API requests to Maxun endpoints originating from unfamiliar IP ranges
- Repeated requests targeting the api_key parameter on routes served by auth.ts
- Presence of Maxun release artifacts at or below version 0.0.28 in production inventories
Detection Strategies
- Audit deployed Maxun instances and compare version strings against the vulnerable range (≤ 0.0.28)
- Inspect application source for the hard-coded key referenced in the public PoC and alert on its presence in runtime images
- Correlate WAF or reverse-proxy logs for anomalous api_key values or high-frequency authentication attempts
Monitoring Recommendations
- Forward Maxun application and reverse-proxy logs to a centralized analytics platform for retention and query
- Baseline normal API consumer behavior and alert on deviations in request volume or geography
- Track outbound connections from the Maxun host to detect post-exploitation data movement
How to Mitigate CVE-2025-15105
Immediate Actions Required
- Restrict network exposure of Maxun API endpoints to trusted networks or VPN-only access until a fixed release is available
- Rotate any credentials, tokens, or downstream API keys managed by the affected Maxun instance
- Remove the hard-coded key from local forks and replace it with an environment-sourced secret
Patch Information
At the time of publication, the vendor had not responded to disclosure and no official patched release is referenced in the advisory. Monitor the Maxun project on GitHub and the VulDB advisory for a fixed version and apply it as soon as it is released.
Workarounds
- Replace the hard-coded key in server/src/routes/auth.ts with a value loaded from an environment variable or secrets manager and rebuild the container image
- Terminate Maxun behind an authenticating reverse proxy that enforces mutual TLS or an additional bearer token independent of the vulnerable api_key flow
- Apply network segmentation so the Maxun service is not reachable from the public internet
# Configuration example: source the signing key from the environment instead of code
export MAXUN_API_SIGNING_KEY="$(openssl rand -hex 32)"
# Restart the Maxun server so the new key is loaded from the environment
systemctl restart maxun
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
