CVE-2025-27955
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
After logging out of Clinical Collaboration Platform 12.2.1.5, the session token stays active and can be reused by attackers to access sensitive patient data or run malicious code. This happens because the logout function doesn't properly invalidate the token.
The platform fails to invalidate session tokens upon logout (CWE-1259), allowing authenticated attackers to reuse valid tokens post-logout to access protected resources and potentially execute arbitrary code. This requires knowledge of a valid token but enables information disclosure and code execution without re-authentication.