CVE-2025-9803
📋 TL;DR
This vulnerability allows account takeover in lunary-ai/lunary due to improper Google OAuth authentication. Attackers can use access tokens from malicious applications to gain unauthorized access to user accounts. All users of version 1.9.34 are affected.
💻 Affected Systems
- lunary-ai/lunary
📦 What is this software?
Lunary by Lunary
⚠️ Risk & Real-World Impact
Worst Case
Complete account takeover leading to data theft, privilege escalation, and unauthorized access to sensitive information.
Likely Case
Unauthorized access to user accounts resulting in data exposure and potential account misuse.
If Mitigated
No impact if proper token validation is implemented and version is patched.
🎯 Exploit Status
Exploitation requires obtaining a Google OAuth token from a malicious application.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.9.35
Vendor Advisory: https://github.com/lunary-ai/lunary/commit/95a2cc8e012bf5f089edbfa072ba66dcb7e10d91
Restart Required: Yes
Instructions:
1. Update lunary to version 1.9.35 or later. 2. Restart the application. 3. Verify the fix by checking the version.
🔧 Temporary Workarounds
Disable Google OAuth
allTemporarily disable Google OAuth authentication until patching is complete.
Modify configuration to disable Google OAuth integration
🧯 If You Can't Patch
- Implement network segmentation to isolate vulnerable systems
- Enable multi-factor authentication for all user accounts
🔍 How to Verify
Check if Vulnerable:
Check if running version 1.9.34 and using Google OAuth integration.Check Version:
Check application version in settings or via package managerVerify Fix Applied:
Verify version is 1.9.35 or later and confirm Google OAuth token validation is enabled.📡 Detection & Monitoring
Log Indicators:
- Unusual authentication patterns
- Multiple failed login attempts followed by successful OAuth login
Network Indicators:
- Unexpected OAuth token requests from unknown applications
SIEM Query:
source="lunary" AND (event="oauth_login" AND status="success") | stats count by user, client_id