NiceGUI is an easy-to-use

CVE-2025-21618 is an *improper authentication/session isolation* flaw in NiceGUI On Air, the framework's remote-sharing feature. In affected nicegui versions <=2.9.0, once one user authenticates to an app exposed through On Air, other browsers—including incognito sessions—can inherit that authenticated state. The vendor fixed it in 2.9.1, and the patch shows the root cause plainly: shared client cookies were being retained between On Air requests.

The vendor's HIGH 7.5 score is technically understandable if you score this as generic unauthenticated network auth bypass. In the real world, it overstates enterprise urgency because exploitation depends on a narrower setup: the app must be using ui.run(on_air=True) or an On Air token, the app must actually rely on NiceGUI auth, and the exposed population is far smaller than ordinary web apps. This is a real bug, but for most estates it is a *demo/tunnel edge-case*, not a Monday-morning fleet fire.

Why this verdict

• Vendor baseline starts high because it is a no-auth network-reachable authentication failure with integrity impact once reachable.
• Major friction: optional feature exposure. The attacker position is only 'unauthenticated remote' *if* the target explicitly enabled NiceGUI On Air; otherwise the bug is unreachable from the internet. That implication alone cuts real-world exposed population hard.
• Second friction: requires a legitimate login event. The attacker typically needs another user to authenticate first, which makes this more like session bleed than a self-contained pre-auth break-in.
• Third friction: application-scoped blast radius. Impact is limited to what that one NiceGUI app exposes; there is no evidence of framework-to-host compromise, RCE, or cross-estate takeover.
• Low threat intel pressure. No KEV listing, no primary-source evidence of campaigns, and a low EPSS signal all argue against keeping the vendor 7.5 intact.

Why not higher?

If this were a default-on web admin surface or a broadly exposed SaaS control plane, the vendor HIGH would stand. But this vulnerability lives behind an optional relay feature and a specific auth usage pattern, which means the exposed population is much smaller than the CVSS vector implies.

Why not lower?

This is still a *real* authentication bypass on publicly reachable apps that use On Air, and exploitation is operationally simple once the conditions are present. For teams that do use On Air for demos, robotics, support, or ad hoc remote access, the impact can be immediate unauthorized access to authenticated functions.

1. Disable on_air where you do not absolutely need it — Remove the vulnerable exposure path entirely by stopping use of ui.run(on_air=True) or persistent On Air tokens on affected apps. For a MEDIUM verdict there is no noisgate mitigation SLA, but this is the fastest risk reduction for any internet-exposed demo or operator console.
2. Gate remote access with your own reverse proxy instead — If the app must be remotely reachable, publish it through your standard ingress stack with SSO, MFA, IP allowlists, and logging instead of the built-in On Air relay. Again, no mitigation SLA for MEDIUM; implement during normal remediation planning, sooner for externally shared apps.
3. Inventory NiceGUI packages in CI and hosts — Use SBOM/SCA or package inventory to find nicegui <=2.9.0, then manually confirm which instances actually use On Air. For MEDIUM, there is no separate mitigation deadline—fold this straight into the remediation workflow before the 365-day patch window closes.
4. Alert on authenticated access without matching login events — For apps you cannot patch immediately, add temporary application logging or proxy correlation to catch browsers gaining authenticated pages without an associated auth event. This is detective-only, not preventive, but it gives you a way to spot live abuse while you remediate.

Run this on the target host, container image, venv, or CI build environment where nicegui is installed. Invoke it with python3 check_nicegui_cve_2025_21618.py; no admin privileges are needed, but it must run in the same Python environment as the app package.

#!/usr/bin/env python3
"""
Check for CVE-2025-21618 in nicegui.
Outputs one of: VULNERABLE / PATCHED / UNKNOWN
Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN
"""

import sys
import os
import re
from pathlib import Path

try:
    from importlib import metadata as importlib_metadata
except Exception:
    import importlib_metadata  # type: ignore


def parse_version(v):
    nums = []
    for part in re.findall(r"\d+", v):
        try:
            nums.append(int(part))
        except ValueError:
            nums.append(0)
    while len(nums) < 3:
        nums.append(0)
    return tuple(nums[:3])


def main():
    try:
        version = importlib_metadata.version('nicegui')
    except importlib_metadata.PackageNotFoundError:
        print('UNKNOWN: nicegui is not installed in this Python environment')
        sys.exit(2)
    except Exception as e:
        print(f'UNKNOWN: unable to read installed package metadata: {e}')
        sys.exit(2)

    installed = parse_version(version)
    vulnerable_floor = (0, 0, 0)
    fixed = (2, 9, 1)

    # Try to inspect the installed source to detect source/backport fixes.
    source_check = None
    try:
        import nicegui.air as air  # type: ignore
        air_file = Path(getattr(air, '__file__', ''))
        if air_file and air_file.exists():
            text = air_file.read_text(encoding='utf-8', errors='ignore')
            if 'self.client.cookies.clear()' in text:
                source_check = 'patched'
            else:
                source_check = 'not_patched'
    except Exception:
        source_check = None

    if source_check == 'patched':
        print(f'PATCHED: nicegui {version} has the cookie-clear fix present in air.py')
        sys.exit(0)

    if vulnerable_floor <= installed < fixed:
        print(f'VULNERABLE: nicegui {version} is older than 2.9.1 and no backport fix was detected')
        sys.exit(1)

    if installed >= fixed:
        print(f'PATCHED: nicegui {version} is 2.9.1 or newer')
        sys.exit(0)

    print(f'UNKNOWN: unable to determine CVE-2025-21618 status for nicegui {version}')
    sys.exit(2)


if __name__ == '__main__':
    main()

Sources

1. NVD CVE-2025-21618
2. GitHub Security Advisory GHSA-v6jv-p6r8-j78w
3. Fix commit 1621a4b
4. Underlying patch commit 343dc0d
5. OSV record for CVE-2025-21618
6. NiceGUI On Air documentation
7. PyPI nicegui release history
8. CISA Known Exploited Vulnerabilities Catalog