Auth bypass in Ams Development Corp. Gams
CVE-2025-41086
Vulnerability in the access control system of the GAMS licensing system that allows unlimited valid licenses to be generated, bypassing any usage restrictions. The validator uses an insecure checksum algorithm; knowing this algorithm and the format of the license lines, an attacker can recalculate the checksum and generate a valid license to grant themselves full privileges without credentials or access to the source code, allowing them unrestricted access to GAMS's mathematical models and commercial solvers.
Vulnerability class: IDOR (Insecure Direct Object Reference)
EPSS: 0.002 (9.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N.
Affected products
- Ams Development Corp. Gams — versions 0
- Gams
Weakness classification (CWE)
References
- cve-coordination@incibe.es (Third Party Advisory)
- cve-coordination@incibe.es (release-notes, Release Notes, patch)
Frequently asked questions
- What is CVE-2025-41086?
- CVE-2025-41086 is a medium-severity vulnerability in Ams Development Corp. Gams, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 6.5/10. Published 2025-12-02.
- How severe is CVE-2025-41086?
- Medium severity. CVSS v3 base score is 6.5 out of 10.