CVE-2025-66432: Oxide Omicron

Medium severity, CVSS 5.0. EPSS: 0.2% chance of exploitation in the next 30 days.

In Oxide control plane 15 through 17 before 17.1, API tokens can be renewed past their expiration date.

Affected products

• Oxide Omicron: from 15, before 17.1 (fixed in 17.1)

Published 2025-11-30. Last modified 2026-06-17.