CVE-2025-9803 Details
Description
lunary-ai/lunary version 1.9.34 is vulnerable to an account takeover due to improper authentication in the Google OAuth integration. The application fails to verify the 'aud' (audience) field in the access token issued by Google, which is crucial for ensuring the token is intended for the application. This oversight allows attackers to use tokens issued to malicious applications to gain unauthorized access to user accounts. The issue is resolved in version 1.9.35.
A vulnerability allowing account takeover has been identified in lunary-ai/lunary version 1.9.34. The issue arises from improper authentication in the Google OAuth integration, where the application fails to verify the 'aud' (audience) field in the access token issued by Google. This oversight allows attackers to use tokens from malicious applications to gain unauthorized access to user accounts. The vulnerability is present in the POST API endpoint '/auth/google', where the access token is processed without the necessary audience validation.
Users can update to lunary-ai/lunary version 1.9.35, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Nov 25, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://huntr.com/bounties/4734f35f-514c-4d10-98fa-3a54514f6af6 | CISA-ADP | ExploitThird Party Advisory |
| https://github.com/lunary-ai/lunary/commit/95a2cc8e012bf5f089edbfa072ba66dcb7e10d91 | [email protected] | Broken Link |
| https://huntr.com/bounties/4734f35f-514c-4d10-98fa-3a54514f6af6 | [email protected] | ExploitThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
| CWE-287 | Improper Authentication | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| lunary lunary | 1.9.34 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Dec 30, 2025 | Initial Analysis | [email protected] |
| Nov 25, 2025 | CVE Modified | CISA-ADP |
| Nov 25, 2025 | New CVE Received | [email protected] |