TI-2025-37280 Aliases CVE-2025-59841

FlagForgeCTF's Improper Session Handling Allows Access After Logout

MEDIUM 49CWE-384Published 2025-09-25 · Updated 2025-09-29

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Spoofing, Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-384 and CWE-613.

Summary

Flag Forge is a Capture The Flag (CTF) platform. In versions from 2.2.0 to before 2.3.1, the FlagForge web application improperly handles session invalidation. Authenticated users can continue to access protected endpoints, such as /api/profile, even after logging out. CSRF tokens are also still valid post-logout, which can allow unauthorized actions. This issue has been patched in version 2.3.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00394 33rd percentileScored 2026-11-07

Fix Fixed flagForge (FlagForgeCTF): 2.3.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
FlagForgeCTF	flagForge	2.2.0 to before 2.3.1	2.3.1	Patch available	CNA

flagForge VendorFlagForgeCTF Affected 2.2.0 to before 2.3.1 Fixed in 2.3.1 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:flagforge:flagforge::::::::	2.2 to before 2.3.1	Vulnerable	FlagForgeCTF

cpe:2.3:a:flagforge:flagforge:*:*:*:*:*:*:*:* Versions 2.2 to before 2.3.1 Vulnerable ·FlagForgeCTF

Remediation

Fix · CNA flagForge (FlagForgeCTF) Fixed in 2.3.1

Timeline

2026-10-02 Threatist record created from CVE-2025-59841

References

Patch 1

https://github.com/FlagForgeCTF/flagForge/commit/304b6c82a4f76871b336404b91e5cdd8a7d7d5bd

Advisory 1

https://github.com/FlagForgeCTF/flagForge/security/advisories/GHSA-h6pr-4cwv-6cjg

TI-2025-38170 FlagForge Allows Unauthenticated Badge Template API Access CVSS 3.1CRITICAL 9.4
TI-2025-37266 FlagForgeCTF is Missing Authorization in main-v2 CVSS 3.1CRITICAL 9.8
TI-2025-37320 FlagForgeCTF Unauthenticated Resource Modification/Deletion CVSS 3.1HIGH 8.6
TI-2026-17569 Flag Forge has ReDoS Vulnerability in User Profile Lookup API CVSS 3.1HIGH 7.5
TI-2025-37272 FlagForgeCTF Hint Exposure via API CVSS 3.1HIGH 7.5
TI-2025-37282 FlagForgeCTF Exposes User Emails via Public /api/user/[username] API CVSS 4.0MEDIUM 6.9

See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences