Auth bypass in Rasahq Rasa-Pro-Security-Advisories
CVE-2025-32377
Rasa Pro is a framework for building scalable, dynamic conversational AI assistants that integrate large language models (LLMs). A vulnerability has been identified in Rasa Pro where voice connectors in Rasa Pro do not properly implement authentication even when a token is configured in the credentials.yml file. This could allow an attacker to submit voice data to the Rasa Pro assistant from an unauthenticated source. This issue has been patched for audiocodes, audiocodes_stream, and genesys connectors in versions 3.9.20, 3.10.19, 3.11.7 and 3.12.6.
Vulnerability class: Broken Authentication
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L.
EPSS exploit prediction
EPSS: 0.005 (38.0th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 38th percentile — 38.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.005 · change: +0.000
Affected products
- Rasahq Rasa-Pro-Security-Advisories — versions >= 3.12.0, < 3.12.6, >= 3.11.0, < 3.11.7, >= 3.10.0, < 3.10.19
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2025-32377?
- CVE-2025-32377 is a medium-severity vulnerability in Rasahq Rasa-Pro-Security-Advisories, classified under Missing Authentication for Critical Function. CVSS score: 6.5/10. Published 2025-04-18.
- How severe is CVE-2025-32377?
- Medium severity. CVSS v3 base score is 6.5 out of 10.