External risk intelligence

DWSurvey Authentication Bypass Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-75325

DWSurvey is a web-based application designed to host surveys and data collection forms. Such applications are typically deployed as internet-facing web services to allow public access for survey participation, making the API endpoints inherently exposed to the network.

Authentication Bypass

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in DWSurvey, a web-based application for surveys and data collection. This issue could allow unauthorized access to the system, potentially impacting the integrity and availability of data. The primary concern is to confirm if this technology is in use and assess any exposure.

Unauthorized access is possible.
Confirm relevance to our technology.
Assess potential exposure and business impact.

Attack Path

How an attacker could exploit the issue

An attacker can bypass authentication in DWSurvey by sending requests to specific API endpoints, potentially gaining unauthorized access to sensitive data or system functions. This vulnerability is exposed externally and does not require any prior user interaction or privileges.

No privileges or user interaction needed.
Access API parameters: /api/dwsurvey/none/ and /api/dwsurvey/up/**.
Unauthorized access to data and functions.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, this vulnerability could allow unauthenticated attackers to bypass authentication mechanisms in DWSurvey, potentially affecting system data and service behavior.

System data and service integrity are at risk.
Exposure could happen via network access.
Unauthorized access and modification may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-world action for this vulnerability likely involves application owners and platform teams responsible for the DWSurvey application. The first step is to identify all instances of DWSurvey, determine their exposure and criticality, and then assign an accountable owner for remediation planning.

Assign application owners for resolution.
Verify network exposure and critical systems.
Plan vendor coordination or mitigation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is DWSurvey?

DWSurvey is a web-based software application used to build and host surveys, questionnaires, and data collection forms. Organizations use it to capture user feedback and aggregate information, which often requires the platform to be reachable by external users.

What does authentication bypass mean for CVE-2026-75325?

This vulnerability is classified as CWE-287, or Improper Authentication. In the context of CVE-2026-75325, it means the application fails to verify who is making a request. An attacker can interact with protected system functions as if they were a logged-in administrator, bypassing the security controls meant to restrict access.

How can an attacker trigger this vulnerability?

An attacker triggers this by sending specially crafted network requests to specific API paths within the application, namely '/api/dwsurvey/none/' and '/api/dwsurvey/up/'. It does not require the attacker to have an existing account, valid credentials, or any interaction from a legitimate user to succeed.

Do I need to worry if my DWSurvey instance is internal?

Halo Surface Signal indicates that DWSurvey is typically designed to be internet-facing for public survey access, which increases the likelihood of external reachability. However, even if your instance is currently on an internal network, any user or device with access to that network could potentially reach these API endpoints and exploit the bypass.

What is the first step to address this CVE?

Your priority is to inventory your environment to locate all running instances of DWSurvey. Once located, identify the application owner for each instance, confirm the network accessibility of the affected API endpoints, and coordinate with your technical team to prioritize remediation planning for these systems.

References

github.com/fangtang7/CVE/blob/main/DWSurvey/DWSurvey%20%E6%9C%AA…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.