vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2025-27580

HIGH
7.5
CVSS Score
Published: April 23, 2025 at 12:00 AM UTC
Updated: June 17, 2026 at 09:03 AM UTC
1 product affected across 1 vendorBRICS

Using BRICS by NIH?

Get instant alerts when new vulnerabilities affect BRICS - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH7.5
Exploit prediction
EPSS 0.7%
SSVC
No known exploit

Description

NIH BRICS (aka Biomedical Research Informatics Computing System) through 14.0.0-67 generates predictable tokens (that depend on username, time, and the fixed 7Dl9#dj- string) and thus allows unauthenticated users with a Common Access Card (CAC) to escalate privileges and compromise any account, including administrators.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

BRICS· Nih
60%
v ≤ 14.0.0-67

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (6)

Source: [email protected]
https://brics.cit.nih.gov
Source: [email protected]
https://bugculture.io/CVE-2025-27580/
Source: [email protected]
https://github.com/RoseHacks/Vulnerability.Research/blob/main/CVE-2025-27580/README.md
Source: [email protected]
https://github.com/brics-dev/brics
Source: [email protected]
https://github.com/brics-dev/brics/blob/26bc6bb627a9a60e6c6a8a8c29735ae98c2e2679/core/src/main/java/gov/nih/tbi/CoreConstants.java#L38
Source: [email protected]
https://github.com/brics-dev/brics/blob/26bc6bb627a9a60e6c6a8a8c29735ae98c2e2679/service/src/main/java/gov/nih/tbi/account/service/complex/AccountManagerImpl.java#L725-L732

SSVC — Action Prioritization

SSVCNo known exploitNot automatableTotal impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

7.5HIGHmitre
Vector?

Quick Info

StatusDEFERRED
CWE
CWE-335

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card