High severity · published Mar 3, 2025
CVE-2025-27422
FACTION Allows Authentication Bypass via User Creation
7.5
CVSS
0.4%
EPSS
No
On KEV
Description
FACTION is a PenTesting Report Generation and Collaboration Framework. Authentication is bypassed when an attacker registers a new user with admin privileges. This is possible at any time without any authorization. The request must follow the validation rules (no missing information, secure password, etc) but there are no other controls stopping them. This vulnerability is fixed in 1.4.3.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FA
faction · factionsecurity
< 1.4.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-27422
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-27422
github.com
https://github.com/factionsecurity/faction/commit/0a6848d388d6dba1c81918cce2772b1e805cd3d6
github.com
https://github.com/factionsecurity/faction/security/advisories/GHSA-97cv-f342-v2jc
More from faction
9.8
CVE-2026-44668
Faction: Unauthenticated Read, Modify, and Delete of Boilerplate Templates
9.8
CVE-2025-66022
FACTION Unauthenticated Custom Extension Upload leads to RCE
8.7
CVE-2026-44669
Faction: Stored XSS in Assessment Attachment Filename Preview Rendering
8.7
CVE-2026-44667
Faction: Stored XSS in Remediation Verification Attachment Filename Preview Rendering