Reflex vulnerable to private state fields modification
Date: 2025-05
Affected: pip/reflex, pip/reflex, pip/reflex
Attack vector: auth-bypass
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2025-47425
CWE: CWE-284
CVSS: 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)

### Summary A user on the website can modify any private field on their own state. ### Details An event meant to modify client side storage had access to modify any field on the state for the given user. This includes non-client side ones and most importantly private fields. This still requires the actor to guess the name for the private fields. ### Impact If one of the States in your app can be modified to allow the user into a different role or a different user this allows the actor to act as someone else or as admin.


Mitigations:

Architectural layers (MAESTRO):