CVE-2025-31966
HCL Sametime is vulnerable to broken server-side validation.
Published Mar 17, 2026 · updated Jun 17, 2026 · hcltech sametime
HCL Sametime is vulnerable to broken server-side validation. While the application performs client-side input checks, these are not enforced by the web server. An attacker can bypass these restrictions by sending manipulated HTTP requests directly to the server.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Mar 17, 2026 · NIST NVD
Detected
HCL Sametime is vulnerable to broken server-side validation. While the application performs client-side input checks, these are not enforced by the web server. An attacker can bypass these restrictions by sending manipulated HTTP requests directly to the server.
Jun 17, 2026 · NIST NVD
Updated
HCL Sametime is vulnerable to broken server-side validation. While the application performs client-side input checks, these are not enforced by the web server. An attacker can bypass these restrictions by sending manipulated HTTP requests directly to the server.
Affected
- cpe hcltech/sametimeversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2025-31966
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2025-31966
HCL Sametime is vulnerable to broken server-side validation. While the application performs client-side input checks, these are not enforced by the web server. An attacker can bypass these restrictions by sending manipulated HTTP requests directly to the server.
nvd.nist.gov