TI-2025-20573 Aliases CVE-2025-27794 GHSA-hg9j-64wp-m9px

Flarum Vulnerable to Session Hijacking via Authoritative Subdomain Cookie Overwrite

MEDIUM 63CWE-74Published 2025-03-12 · Updated 2025-03-12

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: High
Impact type: —
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Flarum is open-source forum software. A session hijacking vulnerability exists in versions prior to 1.8.10 when an attacker-controlled authoritative subdomain under a parent domain (e.g., `subdomain.host.com`) sets cookies scoped to the parent domain (`.host.com`). This allows session token replacement for applications hosted on sibling subdomains (e.g., `community.host.com`) if session tokens aren't rotated post-authentication. Key Constraints are that the attacker must control any subdomain under the parent domain (e.g., `evil.host.com` or `x.y.host.com`), and the parent domain must not be on the Public Suffix List. Due to non-existent session token rotation after authenticating we can theoretically reproduce the vulnerability by using browser dev tools, but due to the browser's security measures this does not seem to be exploitable as described. Version 1.8.10 contains a patch for the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00501 43rd percentileScored 2026-11-07

Fix Fixed framework (flarum): 1.8.10flarum/core (Packagist): 1.8.10+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
flarum	framework	before 1.8.10	1.8.10	Patch available	CNA
—	flarum/core (Packagist)	before 1.8.10	1.8.10	Patch available	GHSA-hg9j-64wp-m9px
—	flarum/framework (Packagist)	before 1.8.10	1.8.10	Patch available	GHSA-hg9j-64wp-m9px

framework Vendorflarum Affected before 1.8.10 Fixed in 1.8.10 Patch available CNA
flarum/core (Packagist) Vendor— Affected before 1.8.10 Fixed in 1.8.10 Patch available GHSA-hg9j-64wp-m9px
flarum/framework (Packagist) Vendor— Affected before 1.8.10 Fixed in 1.8.10 Patch available GHSA-hg9j-64wp-m9px

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:flarum:flarum::::::::	before 1.8.0	Vulnerable	flarum

cpe:2.3:a:flarum:flarum:*:*:*:*:*:*:*:* Versions before 1.8.0 Vulnerable ·flarum

Remediation

Fix · CNA framework (flarum) Fixed in 1.8.10
Fix · GHSA-hg9j-64wp-m9px flarum/core (Packagist) Fixed in 1.8.10 Advisory →
Fix · GHSA-hg9j-64wp-m9px flarum/framework (Packagist) Fixed in 1.8.10 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2025-27794
2026-10-03 Alias added: GHSA-hg9j-64wp-m9px

References

Patch 1

https://github.com/flarum/framework/commit/a05aaea3ee1e0a8b870935183193cd6052f1d402

Advisory 2

Other 2

TI-2021-12339 XSS vulnerability with translator CVSS 3.1CRITICAL 10.0
TI-2023-08736 Post mentions can be used to read any post on the forum without access control CVSS 3.1HIGH 7.7
TI-2022-20279 Cross site scripting vulnerability with discussion titles in flarum CVSS 3.1CRITICAL 9.0
TI-2019-09878 Flarum before 0.1.0-beta.9 allows CSRF against all POST endpoints, as demonstrated by changing admin settings. CVSS 3.0HIGH 8.8
TI-2019-08604 User/Command/ConfirmEmailHandler.php in Flarum before 0.1.0-beta.8 mishandles invalidation of user email tokens. CVSS 3.0HIGH 7.5
TI-2023-20923 Server-Side Request Forgery via Avatar upload in flarum CVSS 3.1HIGH 7.1

See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences