VYPR
← All advisories
High severity8.8NVD Advisory· Published Nov 25, 2025· Updated Jun 17, 2026

CVE-2025-9803

CVE-2025-9803

Description

lunary-ai/lunary version 1.9.34 is vulnerable to an account takeover due to improper authentication in the Google OAuth integration. The application fails to verify the 'aud' (audience) field in the access token issued by Google, which is crucial for ensuring the token is intended for the application. This oversight allows attackers to use tokens issued to malicious applications to gain unauthorized access to user accounts. The issue is resolved in version 1.9.35.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Lunary/Lunary
    cpe:2.3:a:lunary:lunary:1.9.34:*:*:*:*:*:*:*
  • Lunary AI/Lunaryllm-fuzzy2 versions
    <1.9.35+ 1 more
    • (no CPE)range: <1.9.35
    • (no CPE)range: unspecified

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.