Insufficient Session Expiration in alf.io
Priority LOW 35CWE-613Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · Low · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-613.
Summary
Alf.io is a free and open source event attendance management system. In versions prior to 2.0-M4-2402 users can access the admin area even after being invalidated/deleted. This issue has been addressed in version 2.0-M4-2402. All users are advised to upgrade. There are no known workarounds for this vulnerability.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00379 32nd percentileScored 2026-11-07
Fix Fixed alf.io (alfio-event): 2.0-M4-2402
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| alfio-event | alf.io | before 2.0-M4-2402 | 2.0-M4-2402 | Patch available | CNA |
- alf.io Vendoralfio-event Affected before 2.0-M4-2402 Fixed in 2.0-M4-2402 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:alf:alf:*:*:*:*:*:*:*:* | before 2.0-m4-2402 | Vulnerable | alfio-event |
- cpe:2.3:a:alf:alf:*:*:*:*:*:*:*:* Versions before 2.0-m4-2402 Vulnerable ·alfio-event
Remediation
- Fix · CNA alf.io (alfio-event) Fixed in 2.0-M4-2402
Timeline
- 2026-10-02 Threatist record created from CVE-2024-25628
References
More alfio-event Alf vulnerabilities
- TI-2026-27611 alf.io has an Authenticated RCE via Extension Script Sandbox Escape CVSS 3.1CRITICAL 9.1
- TI-2024-16863 IDOR Vulnerability: Allowing Organization Owner to view the other Organizations API KEY and USERS CVSS 3.1HIGH 8.8
- TI-2024-30371 Bypassing promo code limitations with race conditions CVSS 3.1HIGH 7.5
- TI-2024-16862 IDOR make user can read e-mail log sent by other events CVSS 3.1HIGH 7.2
- TI-2023-02118 Improper Neutralization of Special Elements Used in a Template Engine in alfio-event/alf.io CVSS 3.1HIGH 7.2
- TI-2024-30370 alf.io's preloaded data as json is not escaped correctly CVSS 3.1MEDIUM 6.5
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences