CVE-2025-55278: hcl software devops loop
Vulnerability summary
CVE-2025-55278 is a high (CVSS 8.1) vulnerability in hcl software devops loop. EPSS estimates a 0.20% chance of exploitation in the next 30 days, higher than 8.8% of scored vulnerabilities.
Timeline
- 05-11-2025PublishedVulnerability first disclosed.
- 06-11-2025Last modifiedVulnerability information updated.
Description
Improper authentication in the API authentication middleware of HCL DevOps Loop allows authentication tokens to be accepted without proper validation of their expiration and cryptographic signature. As a result, an attacker could potentially use expired or tampered tokens to gain unauthorized access to sensitive resources and perform actions with elevated privileges.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST8.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
EPSS trend
Probability
0.20%
Chance of exploitation in the next 30 days
Percentile
9%
Versus all other CVEs
30-day change
+0.01 pp
From 0.19% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-347Improper Verification of Cryptographic SignatureThe product does not verify, or incorrectly verifies, the cryptographic signature for data.
- CWE-613Insufficient Session ExpirationAccording to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
Affected systems
Hcl software1 product
- devops loop1.0.2
1 vendor · 1 product