CVE-2025-59841

CRITICAL

flagforge 2.2.0-2.3.0 - Insufficient Session Expiration

Title source: llm
STIX 2.1

Description

Flag Forge is a Capture The Flag (CTF) platform. In versions from 2.2.0 to before 2.3.1, the FlagForge web application improperly handles session invalidation. Authenticated users can continue to access protected endpoints, such as /api/profile, even after logging out. CSRF tokens are also still valid post-logout, which can allow unauthorized actions. This issue has been patched in version 2.3.1.

References (2)

Core 2

Scores

CVSS v3 9.8
EPSS 0.0039
EPSS Percentile 30.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-613 CWE-384
Status published
Products (1)
flagforge/flagforge 2.2 - 2.3.1
Published Sep 25, 2025
Tracked Since Feb 18, 2026