CVE-2025-24973

Concorde, formerly know as Nexkey, is a fork of the federated microblogging platform Misskey. Prior to version 12.25Q1.1, due to an improper implementation of the logout process, authentication credentials remain in cookies even after a user has explicitly logged out, which may allow an attacker to steal authentication tokens. This could have devastating consequences if a user with admin privileges is (or was) using a shared device. Users who have logged in on a shared device should go to Settings > Security and regenerate their login tokens. Version 12.25Q1.1 fixes the issue. As a workaround, clear cookies and site data in the browser after logging out.

• CWE-613

• https://github.com/nexryai/concorde/commit/1f6ac9b289906083b132e4f9667a31a60ef83e4e
• https://github.com/nexryai/concorde/security/advisories/GHSA-2369-p2wh-7cc2

Published

Feb 11, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-24968reNgine is an automated reconnaissance framework for web app…8.8
• CVE-2025-24969iTop is an web based IT Service Management tool. Prior to ve…5
• CVE-2025-2497A maliciously crafted DWG file, when parsed through Autodesk…7.8
• CVE-2025-24970Netty, an asynchronous, event-driven network application fra…7.5
• CVE-2025-24971DumpDrop is a stupid simple file upload application that pro…9.5
• CVE-2025-24972Discourse is an open-source discussion platform. Prior to ve…4.3
• CVE-2025-24974DataEase is an open source business intelligence and data vi…6.5
• CVE-2025-24975Firebird is a relational database. Prior to snapshot version…8.8
• CVE-2025-24976Distribution is a toolkit to pack, ship, store, and deliver …6.6
• CVE-2025-24977OpenCTI is an open cyber threat intelligence (CTI) platform.…9.1
• CVE-2025-2498An improper access control in Gitlab EE affecting all versio…4.3
• CVE-2025-24980pimcore/admin-ui-classic-bundle provides a Backend UI for Pi…5.3