{"id":41434,"date":"2025-05-20T23:51:33","date_gmt":"2025-05-20T23:51:33","guid":{"rendered":""},"modified":"2025-08-30T04:39:02","modified_gmt":"2025-08-30T10:39:02","slug":"cve-2025-47781-critical-vulnerability-in-rallly-s-token-based-authentication-system","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-47781-critical-vulnerability-in-rallly-s-token-based-authentication-system\/","title":{"rendered":"CVE-2025-47781: Critical Vulnerability in Rallly’s Token-Based Authentication System<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

We are shedding light on a critical security vulnerability, identified as CVE-2025-47781, that affects Rallly, an open-source scheduling and collaboration tool. This vulnerability has a significant impact on all users of the application, potentially leading to system compromise and data leakage. It lies within the application’s token-based authentication system<\/a>, specifically in versions up to and including 3.22.1. The primary concern arises from the weak entropy of the 6-digit authentication token and absence of brute force protection, permitting unauthorized attackers to gain access to user accounts<\/a>. This blog post aims to provide an in-depth analysis<\/a> of the vulnerability, its potential impact, and recommended mitigation strategies.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2025-47781
\nSeverity: Critical (9.8)
\nAttack Vector: Network
\nPrivileges Required: None
\nUser Interaction: None
\nImpact: System compromise or data leakage<\/a><\/p>\n

Affected Products<\/strong><\/p>\n

Product | Affected Versions<\/p>\n

Rallly | Up to and including 3.22.1<\/p>\n

How the Exploit Works<\/strong><\/p>\n

The vulnerability lies in the token-based authentication<\/a> system of the Rallly application. Upon login, users insert their email, and a 6-digit code is sent to their email address to complete the authentication<\/a>. This token, due to its low entropy, can be easily brute-forced by an attacker<\/a> within the token’s expiration time of 15 minutes. Moreover, the absence of brute force<\/a> protection escalates the risk. An attacker with knowledge of a valid email address could systematically and successfully brute force the token, enabling them to take over the associated account<\/a>.<\/p>\n

Conceptual Example Code<\/strong><\/p>\n

While the exact code to exploit the vulnerability<\/a> is beyond the scope of this article, a conceptual example would involve an iterative process of attempting to authenticate with all possible 6-digit codes. This could be presented in pseudocode as follows:<\/p>\n

for code in range(100000, 999999):\nresponse = requests.post(\n\"https:\/\/www.rallly.co\/api\/auth\/callback\/email\",\ndata={'email': 'target@example.com', 'token': str(code)}\n)\nif response.status_code == 200:\nprint(f\"Successful authentication with token: {code}\")\nbreak<\/code><\/pre>\n
This code fragment illustrates<\/a> the process of attempting authentication with all possible 6-digit codes. On a successful authentication, the process breaks and prints the successful token.<\/p>\n
Mitigation<\/strong><\/p>\n
As of the time of publication, no patched versions are available. However, until a security patch is released by Rallly, users are advised to employ Web<\/a> Application Firewalls (WAF) or Intrusion Detection Systems (IDS) as temporary mitigation. These systems can help detect and prevent potential<\/a> brute force attacks. Furthermore, it is recommended to use unique email addresses not publicly associated with users, reducing the chance for attackers to guess the email addresses used for registration on the application.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview We are shedding light on a critical security vulnerability, identified as CVE-2025-47781, that affects Rallly, an open-source scheduling and collaboration tool. This vulnerability has a significant impact on all users of the application, potentially leading to system compromise and data leakage. It lies within the application’s token-based authentication system, specifically in versions up to […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[1],"tags":[],"vendor":[],"product":[],"attack_vector":[],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-41434","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t