{"id":"CVE-2025-25208","title":"Rhcl: authorino denial of service through authpolicy with sharedsecretref severity","summary":"A Developer persona can bring down the Authorino service, preventing the evaluation of all AuthPolicies on the cluster","severity":"medium","cvss":5.7,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H","cvssSource":"cna","cwe":["CWE-400"],"vendor":"Red Hat","product":"rhcl-operator-container","affected":["rhcl-operator-container 1.0.1","rhcl-operator-container (all versions)","rhoai/odh-model-controller-rhel9 (all versions)"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2025-06-09T18:08:24.170293Z"},"published":"2025-06-09","updated":"2026-11-06","sourceUpdated":"2026-11-06T07:39:08.531Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-25208","references":[{"url":"https://access.redhat.com/security/cve/CVE-2025-25208"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2347436","label":"RHBZ#2347436"}],"tags":["cve.org"],"epss":0.00347,"epssPercentile":0.28493,"ingestedAt":"2026-11-06T07:47:15.871Z","slug":"CVE-2025-25208","body":"## Overview\n\nA Developer persona can bring down the Authorino service, preventing the evaluation of all AuthPolicies on the cluster\n\n## Affected\n\n- `rhcl-operator-container 1.0.1`\n- `rhcl-operator-container (all versions)`\n- `rhoai/odh-model-controller-rhel9 (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":31,"depthScoreParts":{"impact":31.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}