CVE-2025-29995: CAP Back Office Auth Bypass Vulnerability

CVE-2025-29995 Overview

CVE-2025-29995 is a high-severity vulnerability affecting the CAP back office application. The flaw stems from a weak password-reset mechanism implemented at API endpoints. An authenticated remote attacker holding any valid login ID can abuse the vulnerable endpoint to reset another user's password and take over the account. The issue is tracked under CWE-640: Weak Password Recovery Mechanism for Forgotten Password and was disclosed through CERT-IN Vulnerability Note CIVN-2025-0048.

Critical Impact
An authenticated attacker can take over targeted accounts in the CAP back office application by exploiting weak password-reset API logic.

Affected Products

CAP back office application (see CERT-IN advisory CIVN-2025-0048 for vendor and version details)

Discovery Timeline

2025-03-13 - CVE-2025-29995 published to the National Vulnerability Database
2026-04-15 - Last updated in the NVD database

Technical Details for CVE-2025-29995

Vulnerability Analysis

The vulnerability resides in the password-reset API endpoints exposed by the CAP back office application. The reset workflow lacks adequate verification of the requester's identity and authority over the target account. As a result, an authenticated user can submit reset requests that affect other users' credentials. Successful exploitation produces full account takeover, allowing the attacker to authenticate as the victim and access whatever data and functionality that user holds within the back office.

The attack is conducted over the network and requires no user interaction from the victim. The attacker only needs a valid login to the application. According to public scoring data, the EPSS probability is 0.61% (percentile 69.98) as of 2026-05-18, indicating moderate likelihood of exploitation activity relative to other published CVEs.

Root Cause

The root cause is classified as CWE-640: Weak Password Recovery Mechanism for Forgotten Password. The reset endpoint either accepts predictable reset tokens, fails to bind the reset action to the authenticated session, or omits ownership checks on the target account identifier. Any of these gaps allow a logged-in user to drive a password change for an arbitrary account.

Attack Vector

The attacker first authenticates with any valid credential. They then issue a crafted HTTP request to the password-reset API, supplying the victim's account identifier in place of their own. Because the endpoint does not enforce that the reset target matches the authenticated principal, the server completes the operation and updates the victim's credentials. The attacker then signs in with the new password.

No verified proof-of-concept code is published for this issue. Consult the CERT-IN Vulnerability Note CIVN-2025-0048 for vendor-supplied technical detail.

Detection Methods for CVE-2025-29995

Indicators of Compromise

Password-reset API calls in which the authenticated session principal differs from the account identifier being reset.
Successful authentications immediately following a reset event from a source IP or device that has not previously been associated with the affected user.
Bursts of reset requests originating from a single low-privileged account against multiple distinct user IDs.

Detection Strategies

Correlate application audit logs that record userId of the caller against the targetUserId parameter of reset endpoints and alert on mismatches.
Baseline normal password-reset volume per account and flag deviations, especially resets initiated by accounts that historically never trigger them.
Hunt for sequences of reset, login, and privileged action performed within short windows by the same source.

Monitoring Recommendations

Enable verbose audit logging on all authentication and credential-management endpoints in the CAP back office application.
Forward application, web server, and identity provider logs to a centralized analytics platform for cross-source correlation.
Alert security operations on any administrator or finance account whose password changes outside the standard self-service workflow.

How to Mitigate CVE-2025-29995

Immediate Actions Required

Apply the vendor patch referenced in CERT-IN CIVN-2025-0048 as soon as it is available for your deployment.
Restrict network access to the CAP back office application to trusted networks and authenticated administrative users only.
Force a password reset for all back office accounts and invalidate active sessions following remediation.
Audit recent password-reset events and investigate any reset performed by a non-owning principal.

Patch Information

Refer to the CERT-IN Vulnerability Note CIVN-2025-0048 for vendor-supplied fix information. At the time of NVD publication, no separate vendor advisory URLs were listed in the CVE record. Operators should confirm with the application vendor that they are running a build containing the reset-workflow fix.

Workarounds

Disable or proxy the vulnerable password-reset API endpoints until a fixed build is deployed.
Enforce multi-factor authentication on all back office accounts so that a stolen password alone does not grant access.
Add a web application firewall rule that rejects reset requests where the authenticated session identity does not match the targetUserId parameter.
Apply rate limiting on password-reset endpoints to suppress automated abuse from a single authenticated account.

bash

# Example WAF/reverse-proxy rule concept (adapt to your platform)
# Block reset requests where the session user does not match the target user
if ($request_uri ~* "/api/.*/password/reset") {
    if ($http_x_session_user != $arg_targetUserId) {
        return 403;
    }
}