Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-vthb-u9cs-ckak
Vulnerability ID VCID-vthb-u9cs-ckak
Aliases CVE-2025-27794
GHSA-hg9j-64wp-m9px
Summary Flarum Vulnerable to Session Hijacking via Authoritative Subdomain Cookie Overwrite A session hijacking vulnerability exists when an attacker-controlled **authoritative subdomain** under a parent domain (e.g., `subdomain.host.com`) sets cookies scoped to the parent domain (`.host.com`). This allows session token replacement for applications hosted on sibling subdomains (e.g., `community.host.com`) if session tokens aren't rotated post-authentication. **Key Constraints**: - Attacker must control **any subdomain** under the parent domain (e.g., `evil.host.com` or `x.y.host.com`). - Parent domain must **not** be on the [Public Suffix List](https://publicsuffix.org/). Due to non-existent session token rotation after authenticating we can theoretically reproduce the vulnerability by using browser dev tools, but due to the browser's security measures this does not seem to be exploitable as described. ---
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00377 https://api.first.org/data/v1/epss?cve=CVE-2025-27794
cvssv3.1 6.8 https://github.com/flarum/framework
generic_textual MODERATE https://github.com/flarum/framework
cvssv3.1 6.8 https://github.com/flarum/framework/commit/a05aaea3ee1e0a8b870935183193cd6052f1d402
generic_textual MODERATE https://github.com/flarum/framework/commit/a05aaea3ee1e0a8b870935183193cd6052f1d402
ssvc Track https://github.com/flarum/framework/commit/a05aaea3ee1e0a8b870935183193cd6052f1d402
cvssv3.1 6.8 https://github.com/flarum/framework/releases/tag/v1.8.10
generic_textual MODERATE https://github.com/flarum/framework/releases/tag/v1.8.10
ssvc Track https://github.com/flarum/framework/releases/tag/v1.8.10
cvssv3.1 6.8 https://github.com/flarum/framework/security/advisories/GHSA-hg9j-64wp-m9px
generic_textual MODERATE https://github.com/flarum/framework/security/advisories/GHSA-hg9j-64wp-m9px
ssvc Track https://github.com/flarum/framework/security/advisories/GHSA-hg9j-64wp-m9px
cvssv3.1 6.8 https://nvd.nist.gov/vuln/detail/CVE-2025-27794
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2025-27794
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2025-27794
https://github.com/flarum/framework
https://github.com/flarum/framework/commit/a05aaea3ee1e0a8b870935183193cd6052f1d402
https://github.com/flarum/framework/releases/tag/v1.8.10
CVE-2025-27794 https://nvd.nist.gov/vuln/detail/CVE-2025-27794
GHSA-hg9j-64wp-m9px https://github.com/advisories/GHSA-hg9j-64wp-m9px
GHSA-hg9j-64wp-m9px https://github.com/flarum/framework/security/advisories/GHSA-hg9j-64wp-m9px
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N Found at https://github.com/flarum/framework
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N Found at https://github.com/flarum/framework/commit/a05aaea3ee1e0a8b870935183193cd6052f1d402
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-03-12T15:26:50Z/ Found at https://github.com/flarum/framework/commit/a05aaea3ee1e0a8b870935183193cd6052f1d402
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N Found at https://github.com/flarum/framework/releases/tag/v1.8.10
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-03-12T15:26:50Z/ Found at https://github.com/flarum/framework/releases/tag/v1.8.10
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N Found at https://github.com/flarum/framework/security/advisories/GHSA-hg9j-64wp-m9px
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-03-12T15:26:50Z/ Found at https://github.com/flarum/framework/security/advisories/GHSA-hg9j-64wp-m9px
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2025-27794
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.59635
EPSS Score 0.00377
Published At June 5, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-04T16:23:29.660616+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/flarum/core/CVE-2025-27794.yml 38.6.0