Auth bypass in Ams Development Corp. Gams
CVE-2025-41086
Vulnerability in the access control system of the GAMS licensing system that allows unlimited valid licenses to be generated, bypassing any usage restrictions. The validator uses an insecure checksum algorithm; knowing this algorithm and the format of the license lines, an attacker can recalculate the checksum and generate a valid license to grant themselves full privileges without credentials or access to the source code, allowing them unrestricted access to GAMS's mathematical models and commercial solvers.
Vulnerability class: IDOR (Insecure Direct Object Reference)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N.
EPSS exploit prediction
EPSS: 0.002 (10.6th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 11th percentile — 10.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: 0.000
Affected products
- Ams Development Corp. Gams — versions 0
- Gams
Weakness classification (CWE)
References
- www.incibe.es/en/incibe-cert/notices/aviso/authorization-bypass-gams-gams-devel… (Third Party Advisory)
- www.gams.com/latest/docs/RN_51.html (release-notes, Release Notes, patch)
Frequently asked questions
- What is CVE-2025-41086?
- CVE-2025-41086 is a medium-severity vulnerability in Ams Development Corp. Gams, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 6.5/10. Published 2025-12-02.
- How severe is CVE-2025-41086?
- Medium severity. CVSS v3 base score is 6.5 out of 10.