CVE-2025-56643

Requarks Wiki.js 2.5.307 does not properly revoke or invalidate active JWT tokens when a user logs out. As a result, previously issued tokens remain valid and can be reused to access the system, even after logout. This behavior affects session integrity and may allow unauthorized access if a token is compromised. The issue is present in the authentication resolver logic and affects both the GraphQL endpoint and the logout mechanism.

• CWE-613

• https://github.com/0xBS0D27/CVE-2025-56643Third Party Advisory

Published

Nov 18, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-56608The SourceCodester Android application "Corona Virus Tracker…4.2
• CVE-2025-5661A vulnerability, which was classified as problematic, was fo…5.4
• CVE-2025-5662A deserialization vulnerability exists in the H2O-3 REST API…9.8
• CVE-2025-5663A vulnerability has been found in PHPGurukul Auto Taxi Stand…9.8
• CVE-2025-56630FoxCMS v1.2.5 and before is vulnerable to SQL Injection via …7.3
• CVE-2025-5664A vulnerability was found in FreeFloat FTP Server 1.0 and cl…9.8
• CVE-2025-56647npm @farmfe/core before 1.7.6 is Missing Origin Validation i…6.5
• CVE-2025-56648npm parcel 2.0.0-alpha and before has an Origin Validation E…6.5
• CVE-2025-5665A vulnerability was found in FreeFloat FTP Server 1.0. It ha…9.8
• CVE-2025-5666A vulnerability was found in FreeFloat FTP Server 1.0. It ha…9.8
• CVE-2025-5667A vulnerability was found in FreeFloat FTP Server 1.0. It ha…9.8
• CVE-2025-56675The EKEN video doorbell T6 BT60PLUS_MAIN_V1.0_GC1084_2023053…3.5