Auth bypass in Rasahq Rasa-Pro-Security-Advisories
CVE-2025-32377
Rasa Pro is a framework for building scalable, dynamic conversational AI assistants that integrate large language models (LLMs). A vulnerability has been identified in Rasa Pro where voice connectors in Rasa Pro do not properly implement authentication even when a token is configured in the credentials.yml file. This could allow an attacker to submit voice data to the Rasa Pro assistant from an unauthenticated source. This issue has been patched for audiocodes, audiocodes_stream, and genesys connectors in versions 3.9.20, 3.10.19, 3.11.7 and 3.12.6.
Vulnerability class: Broken Authentication
EPSS: 0.004 (36.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L.
Affected products
- Rasahq Rasa-pro-security-advisories — versions >= 3.12.0, < 3.12.6, >= 3.11.0, < 3.11.7, >= 3.10.0, < 3.10.19
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM)
Frequently asked questions
- What is CVE-2025-32377?
- CVE-2025-32377 is a medium-severity vulnerability in Rasahq Rasa-Pro-Security-Advisories, classified under Missing Authentication for Critical Function. CVSS score: 6.5/10. Published 2025-04-18.
- How severe is CVE-2025-32377?
- Medium severity. CVSS v3 base score is 6.5 out of 10.