CVE-2025-21618

7.5 highEPSS 0.4%

High (7.5). EPSS 0.4% chance of exploitation in the next 30 days. Fixed in nicegui 2.9.1.

NiceGUI is an easy-to-use, Python-based UI framework. Prior to 2.9.1, authenticating with NiceGUI logged in the user for all browsers, including browsers in incognito mode. This vulnerability is fixed in 2.9.1.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 33% of CVEs (scores of 2026-10-31)
CWE: CWE-287
Published: 2025-01-06
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-v6jv-p6r8-j78w	PyPI	nicegui	<2.9.1	2.9.1
PYSEC-2026-1705	PyPI	nicegui	<2.9.1	2.9.1

References

https://github.com/zauberzeug/nicegui/commit/1621a4ba6a06676b8094362d36623551e651adc1
https://github.com/zauberzeug/nicegui/security/advisories/GHSA-v6jv-p6r8-j78w

Check your stack JSON