CVE-2025-66001

NeuVector OpenID Connect is vulnerable to man-in-the-middle (MITM)

State: Published
Severity: 8.8 High
Published: Jan 8, 2026
Updated: Jan 8, 2026
Reserved: Nov 19, 2025

Description

NeuVector supports login authentication through OpenID Connect. However, the TLS verification (which verifies the remote server's authenticity and integrity) for OpenID Connect is not enforced by default. As a result this may expose the system to man-in-the-middle (MITM) attacks.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	suse

Weaknesses

CWE-295 Improper Certificate Validation

Affected Products

Product	Versions
neuvectorSUSE	5.3.0 to before 5.4.8Affected

References

https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-66001
https://github.com/neuvector/neuvector/security/advisories/GHSA-4jj9-cgqc-x9h5

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.