CVE-2025-40645: Viday Information Disclosure Vulnerability

CVE-2025-40645 Overview

CVE-2025-40645 is an information disclosure vulnerability in Viday that allows unauthenticated attackers to retrieve sensitive customer data. The flaw resides in the /api/reserva/web/clients endpoint, which accepts a phone parameter via HTTP GET requests without enforcing authentication or authorization controls. An attacker with network access to the application can enumerate customer records by submitting phone numbers, exposing personally identifiable information (PII) belonging to Viday users. The Spanish National Cybersecurity Institute (INCIBE) coordinated the disclosure of this issue, which is categorized under [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor].

Critical Impact
Unauthenticated remote attackers can harvest customer data, including PII, by issuing HTTP GET requests against an unauthenticated API endpoint.

Affected Products

Viday web application
Viday /api/reserva/web/clients API endpoint
Deployments exposing the affected client lookup API to untrusted networks

Discovery Timeline

2025-10-02 - CVE-2025-40645 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-40645

Vulnerability Analysis

The vulnerability stems from missing authentication and authorization checks on a customer lookup API in the Viday application. The endpoint /api/reserva/web/clients accepts a phone query parameter and returns associated customer records without verifying the caller's identity or session. Because the request is a simple HTTP GET, exploitation requires no special tooling beyond a browser or curl. Attackers can iterate over phone number ranges to enumerate customers en masse, transforming the endpoint into a data harvesting interface. The exposed information can include names, contact details, and reservation metadata, depending on the response payload returned by Viday's backend.

Root Cause

The root cause is a broken access control design [CWE-200]. The API route was published without an authentication middleware or authorization policy enforcing that only the legitimate account owner or an authenticated staff user could query customer records. Input filtering on the phone parameter alone does not constrain who may invoke the endpoint, so any network-reachable client can retrieve data.

Attack Vector

Exploitation is network-based and requires no privileges or user interaction. An attacker sends an HTTP GET request such as GET /api/reserva/web/clients?phone=<number> to the Viday host. The server processes the lookup and returns the matching client record in the response body. By scripting requests across a numbering plan, an attacker can perform bulk enumeration of registered customers. Refer to the INCIBE Multiple Vulnerabilities Notice for the original advisory.

Detection Methods for CVE-2025-40645

Indicators of Compromise

Repeated HTTP GET requests targeting /api/reserva/web/clients with varying phone parameter values from the same client IP or user agent.
Anomalous response volumes from the Viday application returning customer records to unauthenticated sessions.
Access log entries showing successful 200 OK responses to /api/reserva/web/clients without a preceding authentication request.

Detection Strategies

Inspect web server and reverse proxy logs for high-frequency or sequential queries against the affected endpoint.
Deploy WAF or API gateway rules that flag unauthenticated calls to /api/reserva/web/clients.
Correlate request patterns indicative of parameter enumeration, such as monotonically incrementing phone values.

Monitoring Recommendations

Forward Viday application and proxy logs to a centralized analytics platform for behavioral baselining of API access.
Alert on spikes in distinct phone values queried per source IP within short time windows.
Track outbound data volumes from the Viday host to identify mass data egress consistent with scraping activity.

How to Mitigate CVE-2025-40645

Immediate Actions Required

Restrict network exposure of the /api/reserva/web/clients endpoint to trusted networks until a vendor fix is applied.
Place the Viday application behind an authenticating reverse proxy or API gateway that rejects anonymous requests to client lookup routes.
Review historical access logs for evidence of prior enumeration and notify affected customers if data exposure is confirmed.

Patch Information

No vendor patch URL is listed in the public CVE record at the time of writing. Operators should monitor the INCIBE Multiple Vulnerabilities Notice and contact the Viday vendor directly for remediation guidance and fixed versions.

Workarounds

Enforce authentication and session validation on /api/reserva/web/clients via a reverse proxy or WAF rule.
Implement rate limiting and per-IP request quotas to slow enumeration attempts against the endpoint.
Mask or remove the phone lookup capability from publicly reachable interfaces until the endpoint requires authenticated access.

bash

# Example NGINX configuration restricting the affected endpoint
location = /api/reserva/web/clients {
    # Require an internal auth subrequest before proxying
    auth_request /_auth;
    limit_req zone=api_clients burst=5 nodelay;
    proxy_pass http://viday_backend;
}

location = /_auth {
    internal;
    proxy_pass http://auth_service/validate;
    proxy_pass_request_body off;
    proxy_set_header Content-Length "";
}