CVE-2025-26377: Q-free Maxtime Auth Bypass Vulnerability

CVE-2025-26377 Overview

CVE-2025-26377 is a missing authorization vulnerability [CWE-862] in Q-Free MaxTime traffic controller software. The flaw resides in the maxprofile/users/routes.lua route handler. Authenticated low-privileged attackers can remove arbitrary users by sending crafted HTTP requests. The vulnerability affects Q-Free MaxTime versions less than or equal to 2.11.0. Successful exploitation impacts integrity and availability of the user management subsystem. Removing administrative accounts can lock out legitimate operators and disrupt traffic management operations.

Critical Impact
Any authenticated user can delete other users, including administrators, leading to loss of access and operational disruption of the MaxTime traffic controller platform.

Affected Products

Q-Free MaxTime versions <= 2.11.0
The vulnerable component is maxprofile/users/routes.lua
Deployments exposing the MaxTime web management interface

Discovery Timeline

2025-02-12 - CVE CVE-2025-26377 published to NVD
2025-10-28 - Last updated in NVD database

Technical Details for CVE-2025-26377

Vulnerability Analysis

The vulnerability is a Missing Authorization flaw [CWE-862] in the user management route handler of MaxTime. The application authenticates the requesting user but fails to verify whether that user holds the privileges required to delete accounts. As a result, the user-removal endpoint executes the action regardless of the caller's role.

The attack requires only valid low-privileged credentials, which can be obtained through standard account provisioning, credential reuse, or phishing. Because Q-Free MaxTime is deployed as a traffic management platform, deletion of operator or administrator accounts directly impacts service availability and trust in audit trails.

Root Cause

The handler in maxprofile/users/routes.lua does not enforce a server-side authorization check before processing the user deletion request. The route relies on the authenticated session without validating role membership or object ownership. This pattern is a textbook Broken Access Control issue.

Attack Vector

An attacker authenticates with any valid account, then issues a crafted HTTP request to the user deletion endpoint targeting another account by identifier. The server processes the request and removes the targeted user. No user interaction is required and the request can be scripted against the network-accessible management interface. See the Nozomi Networks Vulnerability Advisory for additional technical context.

Detection Methods for CVE-2025-26377

Indicators of Compromise

Unexpected DELETE or POST requests to maxprofile/users routes originating from non-administrative sessions
Audit log entries showing user removals performed by low-privileged accounts
Sudden absence of administrator accounts or failed logins from previously valid accounts
HTTP traffic to the MaxTime management interface from unusual source addresses

Detection Strategies

Inspect application access logs for user deletion calls and correlate the actor's role with the action performed
Alert on any state change in the users table that is not preceded by an administrative session
Baseline normal user-management activity and flag deviations in volume or source

Monitoring Recommendations

Forward MaxTime web server and application logs to a centralized SIEM for analysis
Monitor authentication events for low-privileged accounts that subsequently invoke administrative endpoints
Track integrity of the user database with periodic snapshots and diff comparisons

How to Mitigate CVE-2025-26377

Immediate Actions Required

Restrict network access to the MaxTime management interface to trusted operator networks only
Audit existing user accounts and remove unused or shared credentials
Enforce strong, unique passwords and rotate credentials for all low-privileged accounts
Review audit logs for any unauthorized user removals since deployment

Patch Information

Upgrade Q-Free MaxTime to a version greater than 2.11.0 once a fixed release is available from the vendor. Consult the Nozomi Networks Vulnerability Advisory for vendor coordination details and remediation status.

Workarounds

Place the MaxTime management interface behind a VPN or jump host that enforces administrative-only access
Apply network ACLs that block HTTP access to user management routes from non-administrator subnets
Disable or remove low-privileged accounts that do not require interactive access to the platform

bash

# Example firewall rule restricting MaxTime management access
iptables -A INPUT -p tcp --dport 443 -s 10.10.50.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP