CVE-2019-25020: Scytl Secure Vote

High severity, CVSS 7.5. EPSS: 1.3% chance of exploitation in the next 30 days.

An issue was discovered in Scytl sVote 2.1. Because the sdm-ws-rest API does not require authentication, an attacker can retrieve the administrative configuration by sending a POST request to the /sdm-ws-rest/preconfiguration URI.

Affected products

• Scytl Secure Vote: version 2.1 only

Published 2021-02-27. Last modified 2026-06-17.