CVE-2025-22386

An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity session issue exists in the Commerce B2B application, affecting the longevity of active sessions in the storefront. This allows session tokens tied to logged-out sessions to still be active and usable.

• CWE-613
• CWE-613

• https://support.optimizely.com/hc/en-us/articles/32695284701069-Configured-Commerce-Security-Advisory-COM-2024-04Vendor Advisory

Published

Jan 4, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-22377An issue was discovered in Samsung Mobile Processor, Wearabl…6.5
• CVE-2025-2238The Vikinger theme for WordPress is vulnerable to privilege …8.8
• CVE-2025-22381Aggie 2.6.1 has a Host Header injection vulnerability in the…8.2
• CVE-2025-22383An issue was discovered in Optimizely Configured Commerce be…4.6
• CVE-2025-22384An issue was discovered in Optimizely Configured Commerce be…7.5
• CVE-2025-22385An issue was discovered in Optimizely Configured Commerce be…5.9
• CVE-2025-22387An issue was discovered in Optimizely Configured Commerce be…7.5
• CVE-2025-22388An issue was discovered in Optimizely EPiServer.CMS.Core bef…5.7
• CVE-2025-22389An issue was discovered in Optimizely EPiServer.CMS.Core bef…8
• CVE-2025-2239Generation of Error Message Containing Sensitive Information…5.3
• CVE-2025-22390An issue was discovered in Optimizely EPiServer.CMS.Core bef…7.5
• CVE-2025-22391Improper access control for some SigTest before version 6.1.…6.7