CVE-2025-21618: NiceGUI On Air Authentication Bypass Vulnerability
Summary
CVE-2025-21618: NiceGUI On Air authentication issue. Affects nicegui versions < 2.9.1. Fixed in 2.9.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NiceGUI is a Python library that simplifies the creation of user interfaces for web applications. It allows developers to build interactive applications with minimal code, leveraging the power of Python. However, a significant security flaw has been identified in NiceGUI, where once a user logs in from one browser, they remain logged in across all other browsers, including incognito modes, without needing to re-enter their password. This vulnerability raises serious concerns about user session management and security.
Vulnerability Detail
The vulnerability arises from improper session management within the NiceGUI package, specifically related to user authentication. Once a user logs in, their session is not isolated to the browser instance, allowing unauthorized access to their account from any other browser or incognito window. This flaw can lead to unauthorized actions being performed on behalf of the user, potentially compromising sensitive information and user privacy. The vulnerability is classified under CWE-287, which pertains to improper authentication.
How To Fix
Latest published version: 3.18.0 as of 22 Oct 2026
pip install --upgrade "nicegui==3.18.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.9.1
This is the first release that contains the fix.
pip install --upgrade "nicegui==2.9.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users are advised to log out of their sessions in all browsers after use. Additionally, consider using different user accounts for different browsers to mitigate the risk of unauthorized access until the package is updated.
Conclusion
The NiceGUI On Air authentication issue (CVE-2025-21618) presents a significant risk to user security due to improper session management. It is crucial for users and developers to update to the latest version of the package to mitigate this vulnerability. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for nicegui →
FAQ
The vulnerability allows users to remain logged in across multiple browsers without re-authentication, posing a risk of unauthorized access.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
Yes, updating to NiceGUI version 2.9.1 or later provides a permanent fix for this vulnerability.
If you cannot update the package right away, ensure to log out of your sessions and consider using different accounts for different browsers as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for nicegui.
