CVE-2025-56221
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
SigningHub v8.6.8 lacks rate limiting in its login mechanism. Attackers can bypass authentication via brute force attacks.
Risk Assessment
Unlimited login attempts enable password guessing and account takeover, including privileged accounts.
Recommendation
Implement login rate limiting, account lockout, and strong password policies; update SigningHub to a patched version.
Other vulnerabilities in SigningHub
See all- CVE-2025-56218Critical
An arbitrary file upload vulnerability in SigningHub v8.6.8 allows attackers to execute arbitrary code via uploading a crafted PDF file.
- CVE-2025-56224High
A lack of rate limiting in the One-Time Password (OTP) verification endpoint of SigningHub v8.6.8 allows attackers to bypass verification via a bruteforce attack.
- CVE-2025-56223High
Lack of rate limiting in the /Home/UploadStreamDocument component of SigningHub v8.6.8 allows attackers to cause a Denial of Service (DoS) by uploading an excessive number of files.
- CVE-2025-56219High
Incorrect access control in SigningHub v8.6.8 allows attackers to arbitrarily add user accounts without rate limiting, leading to resource exhaustion and Denial of Service (DoS).
Original NVD description (English source)
A lack of rate limiting in the login mechanism of SigningHub v8.6.8 allows attackers to bypass authentication via a brute force attack.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS