---
id: CVE-2025-71455
title: vtenext before 25.02.2 Session Identifier Disclosure via Touch Web Service
summary: >-
  vtenext before 25.02.2 contains a session identifier disclosure vulnerability
  that allows attackers to read the PHPSESSID value returned by the Touch web
  service endpoint. Attackers who can run script in the vtenext origin, such as
  throu…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-200
vendor: vtenext
product: vtenext
affected:
  - vtenext < 25.02.2
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T19:23:26.787003Z'
exploitAvailable: true
published: '2026-11-04'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T19:24:04.539Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-71455'
references:
  - url: 'https://blog.sicuranext.com/vtenext-25-02-a-three-way-path-to-rce/'
  - url: 'https://0xbro.red/posts/vtenext-25-02-a-three-way-path-to-rce/'
  - url: >-
      https://usermanual.vtenext.com/books/release-notes-history/page/vtenext-25022-release-note
  - url: >-
      https://www.vulncheck.com/advisories/vtenext-before-25.02.2-session-identifier-disclosure-via-touch-web-service
    label: >-
      VulnCheck Advisory: vtenext before 25.02.2 Session Identifier Disclosure
      via Touch Web Service
tags:
  - cve.org
  - exploit-available
epss: 0.00338
epssPercentile: 0.27418
ingestedAt: '2026-11-05T22:38:31.536Z'
---

## Overview

vtenext before 25.02.2 contains a session identifier disclosure vulnerability that allows attackers to read the PHPSESSID value returned by the Touch web service endpoint. Attackers who can run script in the vtenext origin, such as through cross-site scripting, can bypass the HttpOnly flag and hijack authenticated sessions.

## Affected

- `vtenext < 25.02.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.