Is CVE-2025-61926 in the CISA KEV catalog?

No. CVE-2025-61926 is not currently on the CISA Known Exploited Vulnerabilities list.

What is the EPSS score for CVE-2025-61926?

CVE-2025-61926 has an EPSS score of 0.36% (28th percentile), estimating the probability of exploitation in the next 30 days.

How do I fix or mitigate CVE-2025-61926?

No published fix for CVE-2025-61926 has been found yet. Check the linked vendor advisories for guidance as it becomes available.

CVE & CISA-KEV Catalog

CVE-2025-61926

UNSCORED

NVD

Description

Allstar is a GitHub App to set and enforce security policies. In versions prior to 4.5, a vulnerability in Allstar’s Reviewbot component caused inbound webhook requests to be validated against a hard-coded, shared secret. The value used for the secret token was compiled into the Allstar binary and could not be configured at runtime. In practice, this meant that every deployment using Reviewbot would validate requests with the same secret unless the operator modified source code and rebuilt the component - an expectation that is not documented and is easy to miss. All Allstar releases prior to v4.5 that include the Reviewbot code path are affected. Deployments on v4.5 and later are not affected. Those who have not enabled or exposed the Reviewbot endpoint are not exposed to this issue.

CWE-453 CWE-798Hard-coded Credentials

How to fix

No published remediation has been found for this vulnerability's affected products yet.

Mitigation guidance may be in the linked vendor advisories in the References section below.

CVSS v3.1 Vector

No CVSS vector data available.

Exploit Intelligence

0.36%probability of exploitation in 30 days

28thpercentile

Low risk: more likely to be exploited than 28% of all known CVEs.

References

Other references4

Embed a live status badge for CVE-2025-61926

Markdown

[![CVE-2025-61926](https://tridentstack.com/cve/badge/CVE-2025-61926.svg)](https://tridentstack.com/cve/CVE-2025-61926)

HTML

<a href="https://tridentstack.com/cve/CVE-2025-61926"><img src="https://tridentstack.com/cve/badge/CVE-2025-61926.svg" alt="CVE-2025-61926"></a>

Find and fix vulnerabilities across your fleet

TridentStack Control continuously scans your Windows, macOS, and Linux fleet for known vulnerabilities, prioritizes them by severity and active exploitation, and patches them automatically.

Start free

This product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2025-10-16.