CVE-2025-65925 — Zeroheight Incorrect Access Control in Account Creation Flow

Disclosure Date: 2025-06-11
Vendor fix date (per vendor): 2025-06-13
Researcher validation date: 2025-06-26
Discovered by: Sneden Rebello

---

Summary

A legacy user creation API pathway allowed accounts to be created without completing the intended email verification step. While unverified accounts could not access product features, this bypass still violated the designed verification and access-control flow and enabled creation of unintended accounts (e.g., spam/fake registrations).

Scope: limited to unauthenticated sign-up flows.
Data exposure: none observed; no access to existing user data or sessions.

---

Impact (high-level)

• Creation of accounts outside intended verification controls
• Potential for spam/fake account flooding and resource/resource-usage impact
• Could contribute to social engineering or chained attack scenarios in broader threat models

MITRE Impact Classification: Denial of Service (resource exhaustion via unintended account creation)

Estimated severity: Medium (authentication/verification logic bypass; no direct data exposure)

CVSS v3.1 Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
CVSS Base Score: 6.5 (Medium)

---

CVE Classification (MITRE)

• Vulnerability Type: Incorrect Access Control
• Attack Type: Remote
• Attack Vector: Network – unauthenticated access to a legacy user creation pathway over HTTPS
• Affected Component: User account creation and verification process (legacy verification-bypass path)
• Vendor Confirmation: Yes

---

Affected

• Product: Zeroheight (SaaS platform)
• Versions: zeroheight (SaaS) – instances prior to 2025-06-13 (vendor-approved public version string)

---

Mitigation (vendor)

Vendor resolved the issue by:

1. Requiring a valid verification token for all account creation flows
2. Improving validation checks before processing new account registrations

These changes ensure that accounts can only be created after completing the intended email verification process.
Users of the platform do not need to take any action beyond ensuring they are on the current service version.

---

Timeline

Note: Both the vendor’s internal fix date (2025-06-13) and the researcher validation date (2025-06-26) are recorded for transparency.

---

Credits

• Researcher: Sneden Rebello (GitHub),(LinkedIn)
• Vendor coordination: Zeroheight security & engineering teams

---

CVE

CVE-2025-65925 is publicly published on cve.org This advisory reflects the public disclosure associated with this CVE.

---

References

• This advisory (public)
• Additional vendor context retained privately at their request

---

Disclosure Policy

This follows coordinated vulnerability disclosure. Public details are intentionally high-level per vendor request; no internal identifiers, infrastructure details, or endpoint specifics are included. See DISCLOSURE_POLICY.md for more.