External risk intelligence

GTT Tax Information System Authentication Bypass via WebSocket Impersonation.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2025-13953

The vulnerability involves authentication via a local WebSocket. While the system may be accessible over a network, the requirement to access a local socket or the local machine environment significantly restricts the attack surface. Public internet exposure is not a typical deployment requirement for this specific authentication mechanism, making external reachability uncommon.

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical bypass vulnerability within the GTT Tax Information System's authentication, specifically impacting its Active Directory login method. The flaw allows an attacker with local machine or internal network access to impersonate legitimate users and potentially compromise the system's data and availability. The primary concern is confirming if this specific authentication mechanism is exposed and relevant to our environment.

Authentication bypass allows unauthorized user access.
Matters if our systems use this tax application.
Confirm relevance and exposure to our environment.

Attack Path

How an attacker could exploit the issue

An attacker could impersonate any user by exploiting a flaw in how the GTT Tax Information System application handles authentication through its local WebSocket. This vulnerability allows an attacker with access to the local machine or internal network to send manipulated data, bypassing the need for valid credentials. If exploited, this could lead to unauthorized access and compromise the confidentiality, integrity, and availability of the application and its data.

Requires access to the local machine or network.
Exploits a flaw in local WebSocket authentication.
Allows any user impersonation.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker with local machine or internal network access to impersonate any user within the domain by manipulating data sent over a local WebSocket used for authentication. This could affect the confidentiality, integrity, and availability of the application and its data.

Application authentication data.
Local network or machine access.
Unauthorized user access.

Operational Fix

Recommended remediation, mitigation, and detection steps

Determining ownership of this vulnerability requires understanding your specific deployment of the GTT Tax Information System. Application owners are primarily responsible for managing the GTT application itself, while infrastructure and platform teams likely manage the underlying systems, including Active Directory and WebSocket infrastructure. Network and security teams should assess exposure and ensure appropriate segmentation, and vendor management should be engaged for potential patches or guidance from GTT. The first practical step is to identify all instances of the GTT Tax Information System, confirm their network accessibility and business criticality, and then identify the accountable owner for remediation planning based on assessed risk.

Application owners should verify asset inventory.
Confirm local network reachability and business impact.
Plan remediation with GTT vendor support.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the GTT Tax Information System?

The GTT Tax Information System is a specialized software platform used to manage tax-related records and processes. It integrates with organizational directory services, such as Active Directory via LDAP, to authenticate users. Organizations rely on it to maintain secure, centralized access to sensitive financial information and administrative taxation workflows.

What does CVE-2025-13953 mean by authentication bypass?

This vulnerability, classified as CWE-290 (Authentication Bypass by Spoofing), occurs because the application fails to verify the source of data arriving through its local WebSocket. Normally, the system should confirm that authentication requests come from a legitimate process. Instead, it accepts manipulated data as valid, effectively allowing an attacker to impersonate any domain user without providing actual passwords or credentials.

How can an attacker trigger this vulnerability?

An attacker needs access to the local machine or the internal network where the GTT Tax Information System is running to communicate with the application's local WebSocket. Simply interacting with the application via a standard web browser interface does not trigger the bug; the exploit requires the ability to inject crafted data directly into the specific WebSocket channel used for the Active Directory login process.

Is my environment at risk from this CVE?

Halo Surface Signal notes that while the system can be network-accessible, the requirement to interact with a local WebSocket environment makes external internet-based exploitation uncommon. Your risk depends on whether your GTT instances are accessible from segments where unauthorized users or malicious software have established a foothold, rather than general internet exposure.

What should I do if I run this software?

First, inventory your organization to locate all running instances of the GTT Tax Information System and identify the teams responsible for them. Verify the network configuration to see if these systems are reachable from untrusted internal segments. Finally, engage your vendor contact for GTT to request official patches or guidance on securing the WebSocket communication method.

References

www.incibe.es/en/incibe-cert/notices/aviso/bypass-authentication-me…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.