CVE-2025-27794

Flarum is open-source forum software. A session hijacking vulnerability exists in versions prior to 1.8.10 when an attacker-controlled authoritative subdomain under a parent domain (e.g., `subdomain.host.com`) sets cookies scoped to the parent domain (`.host.com`). This allows session token replacement for applications hosted on sibling subdomains (e.g., `community.host.com`) if session tokens aren't rotated post-authentication. Key Constraints are that the attacker must control any subdomain under the parent domain (e.g., `evil.host.com` or `x.y.host.com`), and the parent domain must not be on the Public Suffix List. Due to non-existent session token rotation after authenticating we can theoretically reproduce the vulnerability by using browser dev tools, but due to the browser's security measures this does not seem to be exploitable as described. Version 1.8.10 contains a patch for the issue.

• CWE-74

• https://github.com/flarum/framework/commit/a05aaea3ee1e0a8b870935183193cd6052f1d402Patch
• https://github.com/flarum/framework/releases/tag/v1.8.10Release Notes
• https://github.com/flarum/framework/security/advisories/GHSA-hg9j-64wp-m9pxVendor Advisory

Published

Mar 12, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-27788JSON is a JSON implementation for Ruby. Starting in version …7.5
• CVE-2025-27789Babel is a compiler for writing next generation JavaScript. …6.2
• CVE-2025-2779The Insert Headers and Footers Code – HT Script plugin for W…6.5
• CVE-2025-27791Collabora Online is a collaborative online office suite base…8.3
• CVE-2025-27792Opal is OBiBa’s core database application for biobanks or ep…7.7
• CVE-2025-27793Vega is a visualization grammar, a declarative format for cr…5.3
• CVE-2025-27795ReadJXLImage in JXL in GraphicsMagick before 1.3.46 lacks im…7.5
• CVE-2025-27796ReadWPGImage in WPG in GraphicsMagick before 1.3.46 mishandl…9.8
• CVE-2025-27797OS command injection vulnerability in the specific service e…9.8
• CVE-2025-2780The Woffice Core plugin for WordPress, used by the Woffice T…8.8
• CVE-2025-27800The Episerver Content Management System (CMS) by Optimizely …4.8
• CVE-2025-27801The Episerver Content Management System (CMS) by Optimizely …4.8