CVE-2025-31991: Hcltech Devops Velocity

Critical severity, CVSS 9.8. EPSS: 0.2% chance of exploitation in the next 30 days.

Rate Limiting for attempting a user login is not being properly enforced, making HCL DevOps Velocity susceptible to brute-force attacks past the unsuccessful login attempt limit.  This vulnerability is fixed in 5.1.7.

Affected products

• Hcltech Devops Velocity: before 5.1.7 (fixed in 5.1.7)

Published 2026-04-13. Last modified 2026-10-07.