Read the docs
TI-2025-18653 Aliases CVE-2025-24973

Concorde not removing authentication tokens after logging out

Priority MEDIUM 42CWE-613Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-613.

Summary

Concorde, formerly know as Nexkey, is a fork of the federated microblogging platform Misskey. Prior to version 12.25Q1.1, due to an improper implementation of the logout process, authentication credentials remain in cookies even after a user has explicitly logged out, which may allow an attacker to steal authentication tokens. This could have devastating consequences if a user with admin privileges is (or was) using a shared device. Users who have logged in on a shared device should go to Settings > Security and regenerate their login tokens. Version 12.25Q1.1 fixes the issue. As a workaround, clear cookies and site data in the browser after logging out.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00188 8th percentileScored 2026-11-07
Fix Fixed concorde (nexryai): 12.25Q1.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nexryaiconcordebefore 12.25Q1.112.25Q1.1Patch availableCNA
  • concorde Vendornexryai Affected before 12.25Q1.1 Fixed in 12.25Q1.1 Patch available CNA

Remediation

  • Fix · CNA concorde (nexryai) Fixed in 12.25Q1.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-24973

References

Other 2

  • TI-2024-37170 Uncontrolled Recursion and Asymmetric Resource Consumption in Altair media/file proxy CVSS 3.1HIGH 8.6
  • TI-2023-26760 nexkey allows arbitrary users to impersonate any remote user due to missing signature validation CVSS 3.1HIGH 8.6
  • TI-2025-18602 Concorde CSRF vulnerability due to insecure configuration of authentication cookie attributes CVSS 3.1HIGH 8.6
  • TI-2023-28521 External apps using tokens issued by administrators and moderators can call admin APIs CVSS 3.1CRITICAL 9.8
  • TI-2023-23496 Nexkey allows users to bypass authentication of Bull dashboard CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences