{"action":"Upgrade vantage6-server to 4.11.0 or later.","affected":[{"fixed":"4.11.0","introduced":"0"}],"component":"vantage6-server","cve_ids":["CVE-2025-43866"],"ecosystem":"PyPI","epss":0.00387,"exploited":false,"fixed_versions":["4.11.0"],"ghsa_id":"GHSA-m3mq-f375-5vgh","id":"tcs_01M5KGP9GS3H93E7BF7RZYABPX","modified_at":"2026-05-20T09:19:21.163912Z","published_at":"2025-06-12T18:15:20.713Z","references":["https://osv.dev/vulnerability/PYSEC-2025-221","https://github.com/vantage6/vantage6/security/advisories/GHSA-m3mq-f375-5vgh"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"PYSEC-2025-221","url":"https://osv.dev/vulnerability/PYSEC-2025-221"}],"summary":"vantage6 is an open-source infrastructure for privacy preserving analysis. The JWT secret key in the vantage6 server is auto-generated unless defined by the user. The auto-generated key is a UUID1, wh"}