High · 8.1 CVE-2025-13148 EUVD-2025-202872GHSA-wcv9-7cmw-hf38

IBM Aspera Orchestrator Unverified Password Change

Published Dec 11, 2025 · Updated Dec 11, 2025 · Assigned by ibm

Vendor: IBM Product: Aspera Orchestrator

Description

IBM Aspera Orchestrator 4.0.0 through 4.1.0 could allow could an authenticated user to change the password of another user without prior knowledge of that password.

Affected products

Vendor	Product	Affected	Fixed
IBM	Aspera Orchestrator	4.0.0 – ≤ 4.1.0	—

References

https://www.ibm.com/support/pages/node/7254434 vendor-advisory patch