CVE-2025-56332: 
NixOS vulnerability analysis and mitigation

CVE-2025-56332 is an authentication bypass vulnerability in fosrl/pangolin (an open-source, identity-aware VPN and tunneled reverse proxy) affecting versions v1.6.2 and earlier (all versions below v1.7.0). The flaw stems from an insecure default configuration in the authentication rate-limiting system, allowing unauthenticated remote attackers to bypass PIN authentication for protected resources and two-factor authentication (2FA). The vulnerability was publicly disclosed on December 30, 2025, with the CVE received from MITRE on the same date. It carries a CVSS v3.1 base score of 9.1 (Critical), assessed by CISA-ADP (NVD, PoC Gist).

The root cause is classified as CWE-1188 (Insecure Default Initialization of Resource). The official Pangolin installer never configures the auth-specific rate limit (rate_limits.auth), causing all authentication endpoints — including /resource/:resourceId/pincode (PIN-based resource access) and /login (2FA verification) — to fall back to the global rate limit of 500 requests per minute per IP+path. This global limit is wholly inadequate for protecting 6-digit secrets (1,000,000 combinations): at 500 attempts/minute, an attacker can exhaust all PIN or TOTP combinations in approximately 33 hours, and significantly faster by rotating IPs or proxies. The vulnerability requires no authentication, no user interaction, and is exploitable over the network with low complexity (PoC Gist, NVD).

Successful exploitation allows unauthenticated remote attackers to brute-force PIN-protected resources and bypass 2FA on Pangolin instances, gaining unauthorized access to sensitive resources managed by the platform. Since Pangolin provides identity-aware access to private networks, SSH servers, databases, RDP endpoints, and web applications, a successful bypass could expose entire internal network segments to an attacker. The CVSS assessment reflects high confidentiality and integrity impact with no availability impact, as attackers can read sensitive data and modify resources without credentials (PoC Gist, NVD).

A public proof-of-concept (PoC) is available on GitHub Gist, published by the researcher (mrdgef) on December 24, 2025, and referenced by MITRE as an exploit (PoC Gist). As of the time of reporting, there is no confirmed evidence of in-the-wild exploitation, and no threat actor attribution has been made. The EPSS score is approximately 0.039% (low probability of exploitation in the near term). The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (NVD).

1. Reconnaissance: Identify internet-facing Pangolin instances running v1.6.2 or earlier using tools like Shodan or Censys, searching for Pangolin's web interface or API endpoints.
2. Identify target endpoint: Locate the PIN-protected resource endpoint at /resource/:resourceId/pincode or the login endpoint at /login (for 2FA bypass). Resource IDs may be discoverable through the Pangolin web UI or API.
3. Brute-force PIN authentication: Send automated POST requests to /resource/:resourceId/pincode with sequential or randomized 6-digit PIN values. The global rate limit of 500 requests/minute per IP+path allows up to 500 guesses per minute without triggering a lockout.
4. Rotate IPs to accelerate: Use a proxy pool or rotating IP addresses to bypass the per-IP rate limit, dramatically reducing the time to exhaust all 1,000,000 PIN combinations.
5. Bypass 2FA: Similarly, send automated POST requests to /login with valid credentials and brute-forced 6-digit TOTP codes, exploiting the same insufficient global rate limit.
6. Access protected resources: Upon successful PIN or TOTP guess, use the returned session token or cookie to access the protected Pangolin resource, potentially gaining access to internal network services, web applications, or private infrastructure (PoC Gist).

• Network: High volume of POST requests to /resource/:resourceId/pincode or /login endpoints from a single IP or a rotating set of IPs; sequential or randomized 6-digit numeric values in request bodies targeting these endpoints.
• Logs: Pangolin access logs showing hundreds of authentication attempts per minute against /resource/:resourceId/pincode or /login; repeated 401 Unauthorized or 202 Accepted (2FA code requested) responses in rapid succession from the same or rotating source IPs.
• Logs: Successful authentication events (e.g., 200 OK on PIN or login endpoints) immediately following a large number of failed attempts from the same IP range, indicating a successful brute-force.
• Process/Application: Unusual access to PIN-protected resources or admin-level actions shortly after a burst of authentication failures, suggesting a successful bypass.

The vulnerability was remediated by the vendor on 2025-07-18 (per the researcher's disclosure timeline), and the fix is included in Pangolin v1.7.0 and later — users should upgrade immediately (PoC Gist, Pangolin GitHub). As a workaround for those unable to upgrade, administrators should manually configure the rate_limits.auth section in the Pangolin configuration to enforce a strict, low request limit (e.g., 5–10 requests per 15 minutes) on authentication endpoints. Additionally, network segmentation should be applied to restrict access to Pangolin instances to trusted IP ranges only, and monitoring should be enabled for high-volume authentication attempts.

The vulnerability was discussed briefly on Reddit's r/homelab community in the context of tracking software updates for self-hosted tools (Reddit). Red Hat tracked the CVE in their security advisory database (Red Hat). A brief post was noted on Bluesky referencing the CVE. No major vendor statements or significant security researcher commentary beyond the original PoC disclosure have been identified.