Quiet is an alternative to team chat apps like Slack, Discord, and Element that does not require trusting a central server or running one's own. In versions 6.1.0-alpha.4 and below, Quiet's API for backend/frontend communication was using an insecure, not constant-time comparison function for token verification. This allowed for a potential timing attack where an attacker would try different token values and observe tiny differences in the response time (wrong characters fail faster) to guess the whole token one character at a time. This is fixed in version 6.0.1.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
References
History
Fri, 25 Jul 2025 14:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Thu, 24 Jul 2025 22:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Quiet is an alternative to team chat apps like Slack, Discord, and Element that does not require trusting a central server or running one's own. In versions 6.1.0-alpha.4 and below, Quiet's API for backend/frontend communication was using an insecure, not constant-time comparison function for token verification. This allowed for a potential timing attack where an attacker would try different token values and observe tiny differences in the response time (wrong characters fail faster) to guess the whole token one character at a time. This is fixed in version 6.0.1. | |
| Title | Quiet uses insecure, inconsistent verification on local backend token | |
| Weaknesses | CWE-208 | |
| References |
| |
| Metrics |
cvssV4_0
|
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published: 2025-07-24T22:23:58.389Z
Updated: 2025-07-25T13:30:36.230Z
Reserved: 2025-07-14T17:23:35.262Z
Link: CVE-2025-53940
Vulnrichment
Updated: 2025-07-25T13:30:33.612Z
NVD
Status : Awaiting Analysis
Published: 2025-07-24T23:15:26.620
Modified: 2025-07-25T15:29:19.837
Link: CVE-2025-53940
Redhat
No data.