VulnerabilityDeferred

CVE-2025-32898

The KDE Connect verification-code protocol before 2025-04-18 uses only 8 characters and therefore allows brute-force attacks.

MEDIUM 4.7EPSS 0.15%

Does this matter?

Lower severity and a low EPSS score (0.15%). Track it; it rarely justifies an emergency change on its own.

Description

The KDE Connect verification-code protocol before 2025-04-18 uses only 8 characters and therefore allows brute-force attacks. This affects KDE Connect before 1.33.0 on Android, KDE Connect before 25.04 on desktop, KDE Connect before 0.5 on iOS, Valent before 1.0.0.alpha.47, and GSConnect before 59.

CVSS 3.1: 4.7 MEDIUMCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
EPSS: 0.15% probability · 4th percentile
CISA KEV: Not listed
Weakness: CWE-331
Source: cve@mitre.org

References

https://kde.org/info/security/advisory-20250418-3.txt
https://kdeconnect.kde.org

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.