CVE-2025-26344

Summary

CVE-2025-26344 is a vulnerability affecting Q-Free MaxTime versions 2.11.0 and below. It is classified as a CWE-306 "Missing Authentication for Critical Function" issue. An unauthenticated attacker can exploit this flaw by sending crafted HTTP requests to the maxprofile/guest-mode/routes.lua file in the application. Successful exploitation enables passwordless guest mode, posing a significant security risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.