Ecosystem	Package	Version

Vulnerabilities

CVE-2025-32898

CVE-2025-32898

The KDE Connect verification-code protocol before 2025-04-18 uses only 8 characters and therefore allows brute-force attacks. This affects KDE Connect before 1.33.0 on Android, KDE Connect before 25.04 on desktop, KDE Connect before 0.5 on iOS, Valent before 1.0.0.alpha.47, and GSConnect before 59.

Published Dec 5, 2025

https://kde.org/info/security/advisory-20250418-3.txt

CVSS ScoreMedium

4.1

Ecosystem	Package	Version


rpm	kde-connect	1.3.4-1.el8
rpm	kde-connect	1.3.4-1.epel8.playground
rpm	kde-connect	1.4-2.el8
rpm	kde-connect	1.4-2.epel8.playground
rpm	kde-connect	21.04.1-1.el8.next
rpm	kde-connect	21.04.1-1.el8
rpm	kde-connect	21.04.3-1.el9
rpm	kde-connect	21.08.3-2.el8
rpm	kde-connect	21.12.2-3.el9.next
rpm	kde-connect	22.04.1-2.el8.next
rpm	kde-connect	22.04.1-2.el8
rpm	kde-connect	22.04.1-2.el9.next
rpm	kde-connect	22.04.1-2.el9
rpm	kde-connect	22.04.1-3.el9
rpm	kde-connect	22.08.3-1.el9.next
rpm	kde-connect	22.12.1-3.el9.next
rpm	kde-connect	22.12.3-1.el9.next
rpm	kde-connect	22.12.3-1.el9
rpm	kde-connect	23.04.0-1.el9.next
rpm	kde-connect	23.04.3-2.el9.next
rpm	kde-connect	23.04.3-2.el9
rpm	kde-connect	23.08.4-1.el9.next
rpm	kde-connect	23.08.5-2.el9.next
rpm	kde-connect	23.08.5-2.el9
rpm	kde-connect	24.05.2-1.el10_0
rpm	kde-connect	24.08.0-1.el10_0
rpm	kde-connect	24.08.3-1.el10_0
rpm	kde-connect	24.12.0-1.el10_0
rpm	kde-connect	24.12.2-1.el10_0
rpm	kde-connect	24.12.3-1.el10_0
rpm	kde-connect	24.12.3-1.el10_1
rpm	kde-connect	22.04.1-2.0.1.el9
rpm	kde-connect	23.08.5-2.0.1.el9

CVE-2025-32898 | Components Impacted | Sonatype Guide | Sonatype Guide