CVE-2025-24887: OpenCTI Authentication Bypass Vulnerability

CVE-2025-24887 Overview

OpenCTI is an open-source cyber threat intelligence platform used by security teams to aggregate, structure, and share threat data. CVE-2025-24887 is an access control weakness [CWE-284] affecting OpenCTI versions 6.4.8 through 6.4.9. The allow/deny lists that restrict user attribute modification can be bypassed by an authenticated low-privileged user. Attackers can toggle the external flag, change their own token value, and modify attributes such as otp_qr and otp_activated that should be immutable. When external users exist in the deployment, the bypass enables enumeration of user identities. The issue is patched in version 6.4.10.

Critical Impact
A standard low-privileged OpenCTI user can bypass server-side attribute restrictions to modify authentication tokens, disable multi-factor authentication attributes, and enumerate sensitive external user accounts.

Affected Products

OpenCTI 6.4.8
OpenCTI 6.4.9
Patched in OpenCTI 6.4.10

Discovery Timeline

2025-04-30 - CVE-2025-24887 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24887

Vulnerability Analysis

OpenCTI enforces allow/deny lists on the server side to restrict which user attributes a given role can modify. CVE-2025-24887 demonstrates that these lists are not consistently enforced across attribute update paths. An authenticated user can submit mutations that alter attributes outside the allow list, including the API token bound to their own account. Because the API token functions as a bearer credential, changing it directly affects authentication state without password verification. The bypass also permits toggling the external boolean, which controls whether the account is treated as an externally federated identity.

Root Cause

The root cause is improper access control [CWE-284] in the user attribute update logic. The allow/deny list evaluation does not cover all fields exposed through the update interface, letting mutations touch protected fields such as otp_qr, otp_activated, token, and external. Server-side validation trusts that clients honor the intended field scope.

Attack Vector

Exploitation requires an authenticated session with low privileges over the network. The attacker issues GraphQL or REST requests that include restricted attributes in the update payload. By observing response differences when referencing user identifiers, the attacker enumerates existing external accounts. Modifying otp_activated on the attacker's own account weakens multi-factor authentication posture, while overwriting the API token can support session persistence. No user interaction is required, and complexity is low. Refer to the OpenCTI GitHub Security Advisory GHSA-8262-pw2q-5qc3 for the vendor's technical breakdown.

Detection Methods for CVE-2025-24887

Indicators of Compromise

Unexpected changes to the token, external, otp_qr, or otp_activated fields on user records in the OpenCTI database.
Authentication activity using API tokens that do not match tokens issued through normal administrative workflows.
Repeated user-lookup or user-update GraphQL mutations originating from low-privileged accounts.

Detection Strategies

Audit OpenCTI application logs for user update mutations that reference attributes outside the documented allow list.
Correlate token rotation events with the initiating user's role to identify self-service token changes by non-privileged accounts.
Baseline normal user enumeration patterns and alert on bursts of user-object queries from a single session.

Monitoring Recommendations

Forward OpenCTI audit logs to a centralized SIEM and retain user object change history for forensic review.
Enable alerting on modifications to authentication-related attributes such as otp_activated and token.
Review access logs for external user accounts to detect reconnaissance attempts consistent with account enumeration.

How to Mitigate CVE-2025-24887

Immediate Actions Required

Upgrade OpenCTI to version 6.4.10 or later, which enforces the allow/deny lists correctly.
Rotate API tokens for all users after upgrading to invalidate any tokens that may have been altered.
Review user records for unauthorized changes to external, otp_activated, otp_qr, and token fields.

Patch Information

The maintainers released the fix in OpenCTI 6.4.10. Details are published in the OpenCTI GitHub Security Advisory GHSA-8262-pw2q-5qc3. Administrators running versions 6.4.8 or 6.4.9 should upgrade without delay.

Workarounds

Restrict network access to the OpenCTI API so that only trusted analysts can authenticate while patching is scheduled.
Temporarily reduce the number of low-privileged accounts and disable self-registration if enabled.
Enforce mandatory multi-factor authentication at the identity provider layer to reduce reliance on OpenCTI-managed OTP state.

bash

# Upgrade OpenCTI containers to the patched release
docker compose pull
docker compose down
# Update image tag to 6.4.10 (or later) in docker-compose.yml, then:
docker compose up -d