CVE-2025-21618: 
Python vulnerability analysis and mitigation

NiceGUI, a Python-based UI framework, was found to have an authentication vulnerability (CVE-2025-21618) that was disclosed on January 6, 2025. Prior to version 2.9.1, the framework had a significant authentication issue where authenticating with NiceGUI would log in the user across all browsers, including browsers in incognito mode (NVD, GitHub Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. This indicates that the vulnerability can be exploited over the network, requires low attack complexity, needs no privileges or user interaction, and primarily impacts system integrity (GitHub Advisory).

When exploited, this vulnerability allows unauthorized access across multiple browser sessions. Once a user is authenticated in one browser, all other browsers, including those in incognito mode, would automatically be logged in without requiring authentication (NVD).

The vulnerability has been fixed in NiceGUI version 2.9.1. Users are advised to upgrade to this version or later to address the authentication issue (NVD, GitHub Commit).