NixOS nixpkgs up to 25.4/25.10 hard-coded credentials

Summaryinfo

A vulnerability labeled as critical has been found in NixOS nixpkgs up to 25.4/25.10. This impacts an unknown function. The manipulation results in hard-coded credentials. This vulnerability was named CVE-2025-64766. The attack may be performed from remote. There is no available exploit. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as critical has been found in NixOS nixpkgs up to 25.4/25.10. Affected is an unknown part. The manipulation with an unknown input leads to a hard-coded credentials vulnerability. CWE is classifying the issue as CWE-798. The product contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. This is going to have an impact on confidentiality. CVE summarizes:

NixOS's Onlyoffice is a software suite that offers online and offline tools for document editing, collaboration, and management. In versions from 22.11 to before 25.05 and versions before Unstable 25.11, a hard-coded secret was used in the NixOS module for the OnlyOffice document server to protect its file cache. An attacker with knowledge of an existing revision ID could use this secret to obtain a document. In practice, an arbitrary revision ID should be hard to obtain. The primary impact is likely the access to known documents from users with expired access. This issue was resolved in NixOS unstable version 25.11 and version 25.05.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2025-64766 since 11/10/2025. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1110.001.

Upgrading to version 25.05 or 25.11 eliminates this vulnerability. Applying the patch 8e74d05e3de4ee5ad320cd585a7e0f12a4730869 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• NixOS

Name

• nixpkgs

Version

• 25.0
• 25.1
• 25.2
• 25.3
• 25.4
• 25.5
• 25.6
• 25.7
• 25.8
• 25.9
• 25.10

License

• open-source

Website

• Product: https://github.com/NixOS/nixpkgs/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion