CVE-2025-22963

HIGH

Teedy <= 1.11 - Cross-Site Request Forgery via POST /api/user/admin

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2025-22963. PoCs published by samplev45, gmh5225.

AI-analyzed exploit summary This repository contains a writeup describing a CSRF vulnerability (CVE-2025-22963) in Teedy versions <= v1.11, which allows attackers to force authenticated users to change their user information, including passwords, leading to potential account takeover.

Description

Teedy through 1.11 allows CSRF for account takeover via POST /api/user/admin.

Exploits (2)

nomisec WRITEUP
by samplev45 · poc
https://github.com/samplev45/CVE-2025-22963

This repository contains a writeup describing a CSRF vulnerability (CVE-2025-22963) in Teedy versions <= v1.11, which allows attackers to force authenticated users to change their user information, including passwords, leading to potential account takeover.

Classification
Writeup 100%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target: Teedy <= v1.11
Auth required
Prerequisites: Authenticated user session · Victim interaction (e.g., clicking a malicious link)
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WRITEUP
by gmh5225 · poc
https://github.com/gmh5225/CVE-2025-22963

This repository documents a CSRF vulnerability (CVE-2025-22963) in Teedy versions <= v1.11, where an attacker can force a user to change their account details, including passwords, via a crafted POST request to `/api/user/:username`. The writeup includes a detailed explanation, proof-of-concept request, and a proposed fix involving CSRF tokens.

Classification
Writeup 100%
Attack Type
Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target: Teedy <= v1.11
Auth required
Prerequisites: Victim must be authenticated in Teedy · Attacker must know the victim's username
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4

Scores

CVSS v3 7.5
EPSS 0.0027
EPSS Percentile 18.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact total

Details

CWE
CWE-352
Status published
Products (1)
sismics/teedy < 1.11
Published Jan 13, 2025
Tracked Since Feb 18, 2026