{"id":"CVE-2025-66001","title":"NeuVector supports login authentication through OpenID Connect","summary":"NeuVector supports login authentication through OpenID Connect. However, the TLS verification (which verifies the remote server's authenticity and integrity) for OpenID Connect is not enforced by default. As a result this may expose the …","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":["CWE-295"],"vendor":"neuvector","product":"github.com/neuvector/neuvector","affected":["github.com/neuvector/neuvector >= 5.3.0, < 5.4.8"],"patched":["github.com/neuvector/neuvector 5.4.8"],"published":"2026-01-08","updated":"2026-10-07","sourceUpdated":"2026-10-07T09:10:00.160","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-66001","references":[{"url":"https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-66001","label":"meissner@suse.de"},{"url":"https://github.com/neuvector/neuvector/security/advisories/GHSA-4jj9-cgqc-x9h5","label":"meissner@suse.de"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66001"},{"url":"https://github.com/neuvector/neuvector/commit/955904b5762f296d209bf395a5fcc7a40a53c424"},{"url":"https://github.com/neuvector/neuvector"}],"tags":["nvd","osv","go"],"epss":0.00361,"epssPercentile":0.29695,"aliases":["GHSA-4jj9-cgqc-x9h5","GO-2025-4235"],"ecosystem":"go","ingestedAt":"2026-09-12T03:13:01.753Z","slug":"CVE-2025-66001","body":"## Overview\n\nNeuVector supports login authentication through OpenID Connect. However, the TLS verification (which verifies the remote server's authenticity and integrity) for OpenID Connect is not enforced by default. As a result this may expose the system to man-in-the-middle (MITM) attacks.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2025-66001)\n\nAffected packages:\n\n- `github.com/neuvector/neuvector >= 5.3.0, < 5.4.8`\n\nPatched in:\n\n- `github.com/neuvector/neuvector 5.4.8`\n\nSource: https://osv.dev/vulnerability/GHSA-4jj9-cgqc-x9h5","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}