CVE-2025-26374: Q-free Maxtime Auth Bypass Vulnerability

CVE-2025-26374 Overview

CVE-2025-26374 is a Missing Authorization vulnerability [CWE-862] affecting the maxprofile/users/routes.lua users endpoint in Q-Free MaxTime. The flaw lets an authenticated low-privileged attacker enumerate user accounts through crafted HTTP requests. Q-Free MaxTime is a traffic management platform deployed in intelligent transportation system (ITS) environments. All versions up to and including 2.11.0 are affected. Successful enumeration exposes account identifiers that attackers can leverage for credential-based follow-on attacks against the application.

Critical Impact

Authenticated attackers with low privileges can enumerate all user accounts registered in MaxTime, exposing identifiers that enable targeted password attacks and account takeover attempts.

Affected Products

• Q-Free MaxTime versions <= 2.11.0
• maxprofile/users/routes.lua users endpoint
• Deployments exposing the MaxTime web interface to authenticated users

Discovery Timeline

• 2025-02-12 - CVE-2025-26374 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-26374

Vulnerability Analysis

The vulnerability resides in the users endpoint implemented in maxprofile/users/routes.lua. The route handler accepts authenticated requests but fails to verify that the caller holds sufficient privileges to list user records. Any authenticated session, including low-privileged operator accounts, can issue the request and receive the user inventory. The returned data supports reconnaissance against the MaxTime deployment and the broader traffic management environment.

Root Cause

The root cause is a missing authorization check [CWE-862] in the Lua route handler. Authentication verifies the caller's identity but does not evaluate role or permission before returning user data. The endpoint treats any valid session as entitled to the resource. This design assumption breaks least privilege and allows horizontal information disclosure across the user base.

Attack Vector

Exploitation requires network access to the MaxTime web interface and a valid low-privileged account. The attacker authenticates and sends a crafted HTTP request to the users endpoint handled by routes.lua. The server responds with user enumeration data without a privilege check. No user interaction is needed beyond the initial authentication step. The disclosed usernames can seed password spraying, phishing, or lateral movement attempts against the environment.

No public proof-of-concept code is available. Refer to the Nozomi Networks Vulnerability Advisory CVE-2025-26374 for additional technical context.

Detection Methods for CVE-2025-26374

Indicators of Compromise

• Repeated authenticated HTTP requests from a single session to the maxprofile/users endpoint
• Low-privileged accounts issuing requests to administrative or user-management routes
• HTTP responses from the users endpoint containing full account listings served to non-administrative sessions

Detection Strategies

• Review MaxTime web server access logs for requests to maxprofile/users/routes.lua paths originating from accounts without administrative roles
• Correlate authentication events with subsequent high-volume user-directory queries from the same session
• Baseline normal access patterns for the users endpoint and alert on deviations by role

Monitoring Recommendations

• Forward MaxTime application and web server logs to a centralized analytics platform for retention and query
• Monitor for enumeration patterns such as sequential account retrieval or bulk directory responses
• Track failed authentication attempts following access to the users endpoint, which may indicate password spraying against enumerated accounts

How to Mitigate CVE-2025-26374

Immediate Actions Required

• Upgrade Q-Free MaxTime to a version later than 2.11.0 once a fixed release is available from the vendor
• Restrict network access to the MaxTime web interface to trusted operator networks only
• Audit existing MaxTime accounts and remove unused or shared low-privileged credentials
• Rotate credentials for accounts that may have been exposed through prior enumeration

Patch Information

Q-Free MaxTime versions up to and including 2.11.0 are affected. Consult the Nozomi Networks Vulnerability Advisory CVE-2025-26374 and Q-Free support channels for the current fixed version and upgrade guidance. No vendor advisory URL is listed in the NVD record at the time of publication.

Workarounds

• Place the MaxTime web interface behind a network segmentation boundary or VPN that limits access to administrators
• Apply web application firewall rules that block requests to maxprofile/users paths from non-administrative source identities when feasible
• Enforce strong, unique passwords and multi-factor authentication where supported to reduce the value of enumerated usernames

# Example reverse-proxy restriction for the users endpoint
location /maxprofile/users {
    allow 10.0.0.0/24;   # admin management subnet
    deny all;
    proxy_pass http://maxtime-backend;
}