CVE-2025-49591: Xwiki CryptPad Auth Bypass Vulnerability

CVE-2025-49591 Overview

CVE-2025-49591 is an Authentication Bypass vulnerability in CryptPad, the open-source collaboration suite developed by XWiki. Prior to version 2025.3.0, the enforcement of Two-Factor Authentication (2FA) in CryptPad can be trivially bypassed due to weak implementation of access controls. An attacker that compromises a user's credentials can gain access to the victim's account, even if the victim has 2FA enabled.

The vulnerability stems from a flaw in how CryptPad validates path parameters for 2FA enforcement. The 2FA check is not enforced if the path parameter is not exactly 44 characters long, which can be bypassed by simply URL encoding a single character in the path. This allows attackers to circumvent a critical security control designed to protect user accounts.

Critical Impact

Attackers with stolen credentials can completely bypass Two-Factor Authentication protection, rendering 2FA ineffective and allowing unauthorized account access to sensitive collaboration documents and data.

Affected Products

• XWiki CryptPad versions prior to 2025.3.0
• CryptPad collaboration suite deployments using affected versions
• Self-hosted CryptPad instances running vulnerable code

Discovery Timeline

• 2025-06-18 - CVE-2025-49591 published to NVD
• 2025-08-11 - Last updated in NVD database

Technical Details for CVE-2025-49591

Vulnerability Analysis

This Authentication Bypass vulnerability exists in CryptPad's access control implementation within the lib/http-worker.js file. The core issue lies in how the application validates block identifiers before enforcing Two-Factor Authentication requirements.

The vulnerable code checks whether the path parameter name is exactly 44 characters long—the expected length of a base64-encoded public key. If the length check fails, the application was incorrectly allowing the request to proceed to the next middleware handler without enforcing 2FA, rather than rejecting invalid requests outright.

An attacker can exploit this by URL-encoding a single character in the path, changing the byte length of the path string. Since URL-encoded characters (e.g., %2F instead of /) consume three bytes instead of one, this manipulation causes the length check to fail, bypassing the 2FA enforcement entirely.

Root Cause

The root cause is an improper access control implementation (CWE-284) where the application used a permissive "fail-open" design. When the path validation check failed due to unexpected input length, instead of denying access with an error response, the code called next() to continue processing the request. This allowed attackers to manipulate input to bypass security controls that should have been mandatory.

The flawed logic assumed that any request not matching the expected 44-character base64 format should simply be passed through, rather than treated as potentially malicious input that should be rejected.

Attack Vector

The attack is network-based and requires low complexity to execute. An attacker needs compromised user credentials (username and password) but can then bypass 2FA protection through URL manipulation. The attack flow involves:

1. Obtaining valid user credentials through phishing, credential stuffing, or other means
2. Initiating a login request to the target CryptPad instance
3. URL-encoding one or more characters in the block path parameter to change its length from 44 characters
4. The length validation fails, causing the 2FA check to be skipped
5. Attacker gains full access to the victim's account and all associated documents

// Vulnerable code before patch (lib/http-worker.js)
// Block access control only applies to files
// identified by base64-encoded public keys
// skip everything else, ie. /block/placeholder.txt
if (typeof(name) !== 'string' || name.length !== 44) {
    return void next();  // VULNERABLE: allows bypass
}

var authorization = req.headers.authorization;

Source: CryptPad GitHub Commit

Detection Methods for CVE-2025-49591

Indicators of Compromise

• Unusual URL-encoded characters in block path requests within CryptPad access logs
• Successful authentication events without corresponding 2FA verification entries
• Login attempts with path parameters that contain % encoded characters
• Multiple failed 2FA attempts followed by successful access from the same source

Detection Strategies

• Monitor web server logs for requests to /block/ endpoints containing URL-encoded characters such as %2F, %2B, or %3D
• Implement log correlation to identify authentication events that lack corresponding 2FA verification records
• Deploy web application firewall (WAF) rules to detect and alert on unusual URL encoding patterns in authentication flows
• Review access logs for anomalous session creation events that bypass normal 2FA workflows

Monitoring Recommendations

• Enable verbose logging for CryptPad authentication events and 2FA verification attempts
• Set up alerts for authentication anomalies where 2FA-protected accounts are accessed without 2FA completion
• Monitor for unusual patterns of URL encoding in requests to block endpoints
• Implement real-time log analysis to correlate login events with 2FA verification status

How to Mitigate CVE-2025-49591

Immediate Actions Required

• Upgrade CryptPad to version 2025.3.0 or later immediately
• Review authentication logs for signs of potential exploitation before patching
• Force password resets for any accounts where suspicious access patterns are detected
• Audit all 2FA-enabled accounts to verify account integrity after upgrade

Patch Information

The vulnerability has been patched in CryptPad version 2025.3.0. The fix addresses the issue through two commits that correct the access control logic in lib/http-worker.js:

The primary fix changes the behavior when an invalid block ID is detected. Instead of calling next() to continue processing (allowing bypass), the patched code now returns a 404 status with an INVALID_ID error:

// Patched code (lib/http-worker.js)
// Block access control only applies to files
// identified by base64-encoded public keys
// skip everything else, ie. /block/placeholder.txt
if (/placeholder\.txt(\?.+)?/.test(parsed.base)) {
    return void next();
}
if (typeof(name) !== 'string' || name.length !== 44) {
    return void res.status(404).json({
        error: "INVALID_ID",
    });
}

var authorization = req.headers.authorization;

Source: CryptPad Security Patches

For detailed patch information, refer to the GitHub Security Advisory.

Workarounds

• If immediate patching is not possible, implement a reverse proxy or WAF rule to block requests containing URL-encoded characters in block path parameters
• Temporarily disable external access to CryptPad instances until patching can be completed
• Implement additional network-level authentication requirements (VPN, IP allowlisting) as a defense-in-depth measure
• Monitor authentication logs intensively for bypass attempts until the patch is applied

# Example nginx configuration to block potential bypass attempts
# Add to server block for CryptPad reverse proxy
location /block/ {
    # Reject requests with URL-encoded characters in block paths
    if ($request_uri ~* "%[0-9a-fA-F]{2}") {
        return 403;
    }
    proxy_pass http://cryptpad_backend;
}