CVE-2025-64483: Wazuh API Authentication Bypass Vulnerability

CVE-2025-64483 Overview

CVE-2025-64483 is an improper access control vulnerability [CWE-284] in Wazuh, an open source security detection, visibility, and compliance platform. The flaw exists in the Wazuh API Agent Configuration endpoint from version 4.9.0 up to but not including 4.13.0. In certain configurations, authenticated users assigned read-only API roles can retrieve agent enrollment credentials by querying the /utils/configuration endpoint. Those credentials permit registration of new agents inside the same Wazuh tenant without any elevated permissions in the user interface. Wazuh addressed the issue in version 4.13.0.

Critical Impact
Low-privileged authenticated users can obtain agent enrollment credentials and register unauthorized agents within the same Wazuh tenant, bypassing role-based restrictions.

Affected Products

Wazuh Dashboard Plugins version 4.9.0
Wazuh Dashboard Plugins versions 4.9.x through 4.12.x
Fixed in Wazuh 4.13.0

Discovery Timeline

2025-11-21 - CVE-2025-64483 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-64483

Vulnerability Analysis

The Wazuh Dashboard exposes an API endpoint at /utils/configuration that returns the plugin's runtime configuration. The response payload includes the enrollment.password setting, which authenticates new agents to the Wazuh manager during registration. The role-based access control layer permits read-only roles to reach this endpoint, treating configuration retrieval as a low-sensitivity operation. Because enrollment credentials are embedded in that payload, any authenticated user meeting the read-only threshold can extract them.

An attacker holding a read-only API token can then invoke agent registration flows using the leaked password. The manager accepts the enrollment because the credential is valid, and the newly registered agent lives inside the same tenant as legitimate endpoints. This undermines tenant isolation and role separation in multi-user Wazuh deployments.

Root Cause

The root cause is the inclusion of the enrollment.password field in the configuration schema returned to any caller of /utils/configuration. The setting was declared in plugins/wazuh-core/common/constants.ts and merged into responses used by the agent registration UI. No authorization filter stripped the sensitive value based on the caller's role.

Attack Vector

Exploitation requires network access to the Wazuh Dashboard API and valid credentials for an account with a read-only API role. The attacker authenticates, requests /utils/configuration, parses enrollment.password from the response, and then submits an agent enrollment request to the manager using the recovered secret.

typescript

// Patch: remove enrollment.password fallback in register-agent component
 useEffect(() => {
   const fetchData = async () => {
     try {
-      const wazuhVersion = await getWazuhVersion();
-      const { auth: authConfig } = await getMasterConfig();
+      const [wazuhVersion, masterConfig, groups] = await Promise.all([
+        getWazuhVersion(),
+        getMasterConfig(),
+        getGroups(),
+      ]);
+      const { auth: authConfig } = masterConfig;
       let wazuhPassword = '';
       const needsPassword = authConfig?.auth?.use_password === 'yes';
       if (needsPassword) {
-        wazuhPassword =
-          configuration?.['enrollment.password'] ||
-          authConfig?.['authd.pass'] ||
-          '';
+        wazuhPassword = authConfig?.['authd.pass'] || '';
       }
-      const groups = await getGroups();

Source: Wazuh Dashboard Plugins commit eac859f

Detection Methods for CVE-2025-64483

Indicators of Compromise

Unexpected HTTP GET requests to /utils/configuration originating from accounts with read-only API roles.
Agent enrollment events (authd registration entries) tied to source addresses that do not match managed endpoint inventory.
New agents appearing in the Wazuh manager with names or IP ranges outside approved onboarding scopes.

Detection Strategies

Review Wazuh Dashboard access logs for repeated calls to /utils/configuration correlated with the same user session.
Compare agent registration timestamps against change tickets or provisioning records to flag unauthorized enrollments.
Alert when a read-only API role account performs any action that precedes an authd enrollment event within a short time window.

Monitoring Recommendations

Ingest Wazuh manager and dashboard logs into a central SIEM or data lake and build rules on the authd enrollment channel.
Track the total agent count per tenant and alert on growth outside expected onboarding cadence.
Audit API role assignments periodically to confirm read-only accounts do not retain access beyond documented need.

How to Mitigate CVE-2025-64483

Immediate Actions Required

Upgrade Wazuh Dashboard Plugins to version 4.13.0 or later on all deployments running 4.9.0 through 4.12.x.
Rotate the agent enrollment password (authd.pass) after upgrading to invalidate any credentials that may have been exfiltrated.
Review the list of registered agents and remove any enrollments that cannot be attributed to a documented onboarding workflow.

Patch Information

The fix is delivered in Wazuh 4.13.0 through the commit eac859f1ad0bf5eb8b0dbc7ea7eeef4bd22c3722, which removes the enrollment.password field from the configuration schema and updates the register-agent component to source the password only from authd.pass. Details are published in GitHub Security Advisory GHSA-gwf3-8gm3-qrmj.

Workarounds

Restrict network access to the Wazuh Dashboard API so that only trusted administrative users can authenticate against it.
Audit API role assignments and remove read-only roles from users who do not require configuration visibility until the upgrade is applied.
Where feasible, disable password-based agent enrollment (use_password: no) and rely on manual key provisioning until patched.

bash

# Verify installed Wazuh Dashboard plugin version and upgrade
curl -k -u <admin>:<pass> https://<wazuh-dashboard>/api/status | jq '.version'

# Rotate the agent enrollment password on the manager
sudo /var/ossec/bin/manage_agents
# then update /var/ossec/etc/authd.pass with a new value and restart
sudo systemctl restart wazuh-manager