CVE-2025-66001

—

CVSS 3.1

8.8 high

EPSS

<1%p30

Published

Jan 8, 2026 (Jan 8, 2026)

Modified

Jun 17, 2026

Description

NeuVector supports login authentication through OpenID Connect. However, the TLS verification (which verifies the remote server's authenticity and integrity) for OpenID Connect is not enforced by default. As a result this may expose the system to man-in-the-middle (MITM) attacks.

Weakness: CWE-295
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.4%)

In the news0 stories

No ingested article mentions this CVE yet.