CVE-2025-32898
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
The KDE Connect verification-code protocol before 2025-04-18 uses only 8 characters and therefore allows brute-force attacks. This affects KDE Connect before 1.33.0 on Android, KDE Connect before 25.04 on desktop, KDE Connect before 0.5 on iOS, Valent before 1.0.0.alpha.47, and GSConnect before 59.
Risk Assessment
The risk involves the possibility of breaking connection verification by an attacker, which could lead to unauthorized access to user devices and data.
Recommendation
It is recommended to update all affected components (KDE Connect, Valent, GSConnect) to the latest versions that include a fix increasing the verification code length.
Other vulnerabilities in KDE Connect
See all- CVE-2025-66270Medium
The KDE Connect protocol 8 before 2025-11-28 does not correlate device IDs across two packets. This affects KDE Connect before 25.12 on desktop, KDE Connect before 0.5.4 on iOS, KDE Connect before 1.34.4 on Android, GSConnect before 68, and Valent before 1.0.0.alpha.49.
- CVE-2025-32900Medium
In the KDE Connect information-exchange protocol before 2025-04-18, a packet can be crafted to temporarily change the displayed information about a device, because broadcast UDP is used. This affects KDE Connect before 1.33.0 on Android, KDE Connect before 25.04 on desktop, KDE Connect before 0.5 on iOS, Valent before 1.0.0.alpha.47, and GSConnect before 59.
Original NVD description (English source)
The KDE Connect verification-code protocol before 2025-04-18 uses only 8 characters and therefore allows brute-force attacks. This affects KDE Connect before 1.33.0 on Android, KDE Connect before 25.04 on desktop, KDE Connect before 0.5 on iOS, Valent before 1.0.0.alpha.47, and GSConnect before 59.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS