Read the docs
TI-2025-31132 Aliases CVE-2025-49004

Hijacking Caido instance during the initial setup via DNS Rebinding to achieve RCE

Priority LOW 36CWE-290Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-290.

Summary

Caido is a web security auditing toolkit. Prior to version 0.48.0, due to the lack of protection for DNS rebinding, Caido can be loaded on an attacker-controlled domain. This allows a malicious website to hijack the authentication flow of Caido and achieve code execution. A malicious website loaded in the browser can hijack the locally running Caido instance and achieve remote command execution during the initial setup. Even if the Caido instance is already configured, an attacker can initiate the authentication flow by performing DNS rebinding. In this case, the victim needs to authorize the request on dashboard.caido.io. Users should upgrade to version 0.48.0 to receive a patch.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00652 51st percentileScored 2026-11-07
Fix Fixed caido (caido): 0.48.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
caidocaidobefore 0.48.00.48.0Patch availableCNA
  • caido Vendorcaido Affected before 0.48.0 Fixed in 0.48.0 Patch available CNA

Remediation

  • Fix · CNA caido (caido) Fixed in 0.48.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-49004
  2. 2026-11-05 EPSS moved to the 50th–90th percentile

References

Other 1

  • TI-2026-20052 Caido has an insufficient patch for DNS rebind leading to RCE CVSS 3.1CRITICAL 9.8
  • TI-2025-33726 Caido Toast Vulnerable to Reflected Cross-site Scripting CVSS 3.1MEDIUM 6.3
  • TI-2025-16849 Cross Site Scripting on URL decode Tooltip in Caido CVSS 3.1MEDIUM 5.2
  • TI-2025-40551 Caido Improperly Handles External Links in Markdown CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences