MediumFix available
gnome-shell-extension-gsconnect, kdeconnect — security advisory
The KDE Connect protocol 8 before 2025-11-28 does not correlate device IDs across two packets. This affects KDE Connect before 25.12 on desktop, KDE Connect before 0.5.4 on iOS, KDE Connect before 1.34.4 on Android, GSConnect before 68, and Valent before 1.0.0.alpha.49.
- Products
- gnome-shell-extension-gsconnect, kdeconnect
- Affected versions
- 25.04.2-1, 25.08.1-1, 62-1, 67-1, 67-2
- Fixed versions
- 25.04.2-1+deb13u1, 25.11.80+git20251121.7090b106-1, 62-1+deb13u1, 71-1
- CVEs
- CVE-2025-66270
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 23:00 UTC · Revision 1
Source evidence
The KDE Connect protocol 8 before 2025-11-28 does not correlate device IDs across two packets. This affects KDE Connect before 25.12 on desktop, KDE Connect before 0.5.4 on iOS, KDE Connect before 1.34.4 on Android, GSConnect before 68, and Valent before 1.0.0.alpha.49.
osv:DEBIAN-CVE-2025-66270
gnome-shell-extension-gsconnect
Fixed versions: 62-1+deb13u1
gnome-shell-extension-gsconnect
Fixed versions: 71-1
kdeconnect
Fixed versions: 25.04.2-1+deb13u1
kdeconnect
Fixed versions: 25.11.80+git20251121.7090b106-1
Complete source record
{
"id": "e83e38fec58e9f18a87738b7f2a7a8912e9af7e5947b194417fa405efe286854",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2025-66270",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2025-66270",
"summary": "The KDE Connect protocol 8 before 2025-11-28 does not correlate device IDs across two packets. This affects KDE Connect before 25.12 on desktop, KDE Connect before 0.5.4 on iOS, KDE Connect before 1.34.4 on Android, GSConnect before 68, and Valent before 1.0.0.alpha.49.",
"evidence": "osv:DEBIAN-CVE-2025-66270",
"products": [
{
"name": {
"value": "gnome-shell-extension-gsconnect",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "62-1+deb13u1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": [
{
"value": "62-1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "gnome-shell-extension-gsconnect",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "71-1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": [
{
"value": "62-1",
"evidence": "/affected/1/versions"
},
{
"value": "67-1",
"evidence": "/affected/1/versions"
},
{
"value": "67-2",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "kdeconnect",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "25.04.2-1+deb13u1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": [
{
"value": "25.04.2-1",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "kdeconnect",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "25.11.80+git20251121.7090b106-1",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": [
{
"value": "25.04.2-1",
"evidence": "/affected/3/versions"
},
{
"value": "25.08.1-1",
"evidence": "/affected/3/versions"
}
]
}
],
"severity": "medium",
"structured": {
"id": "DEBIAN-CVE-2025-66270",
"aliases": [
"DEBIAN-CVE-2025-66270"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "62-1+deb13u1"
}
]
}
],
"package": {
"name": "gnome-shell-extension-gsconnect",
"purl": "pkg:deb/debian/gnome-shell-extension-gsconnect?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"62-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-66270.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "71-1"
}
]
}
],
"package": {
"name": "gnome-shell-extension-gsconnect",
"purl": "pkg:deb/debian/gnome-shell-extension-gsconnect?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"62-1",
"67-1",
"67-2"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-66270.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "25.04.2-1+deb13u1"
}
]
}
],
"package": {
"name": "kdeconnect",
"purl": "pkg:deb/debian/kdeconnect?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"25.04.2-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-66270.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "25.11.80+git20251121.7090b106-1"
}
]
}
],
"package": {
"name": "kdeconnect",
"purl": "pkg:deb/debian/kdeconnect?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"25.04.2-1",
"25.08.1-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-66270.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-23T17:47:32.179794226Z",
"provider": "osv",
"upstream": [
"CVE-2025-66270"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2025-66270"
]
},
"related_cves": [
{
"value": "CVE-2025-66270",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 417494,
"published_at": "2025-12-05T06:16:09.253+00:00"
}