CVE-2025-59841: falha crítica em FlagForgeCTF flagForge
FlagForgeCTF's Improper Session Handling Allows Access After Logout
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.8epss 0.4%
Flag Forge is a Capture The Flag (CTF) platform. In versions from 2.2.0 to before 2.3.1, the FlagForge web application improperly handles session invalidation. Authenticated users can continue to access protected endpoints, such as /api/profile, even after logging out. CSRF tokens are also still valid post-logout, which can allow unauthorized actions. This issue has been patched in version 2.3.1.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
FlagForgeCTF · flagForgeCVEs relacionadas — FlagForgeCTF flagForge
No mesmo produto, das mais perigosas para as menos.
CVE-2025-61777CRITICALFlagForge Allows Unauthenticated Badge Template API AccessEPSS 0.5%CVE-2025-59843MEDIUMFlagForgeCTF Exposes User Emails via Public /api/user/[username] APIEPSS 0.4%CVE-2025-59827HIGHFlagForgeCTF is Missing Authorization in main-v2EPSS 0.4%CVE-2025-59932HIGHFlagForgeCTF Unauthenticated Resource Modification/DeletionEPSS 0.4%CVE-2025-59833HIGHFlagForgeCTF Hint Exposure via APIEPSS 0.3%CVE-2026-21868HIGHFlag Forge has ReDoS Vulnerability in User Profile Lookup APIEPSS 0.3%