Vulnerabilities

TI-2025-24588 CVE-2025-35433 · GHSA-mxh5-f83r-vf79

Insufficient session expiration in CISA Thorium

LOW 12

CISA Thorium does not properly invalidate previously used tokens when resetting passwords.

CVSS 4.0LOW 2.3 Network Low privileges No interaction EPSS 0.00283 Published 2025-09-17 Fixed in 1.1.1 CWE-613

TI-2025-24587 CVE-2025-35432 · GHSA-wc3h-h5hx-5r6h

LOW 37

CISA Thorium does not rate limit requests to send account verification email messages.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00562 Published 2025-09-17 Fixed in 1.1.1 CWE-400

TI-2025-24586 CVE-2025-35431 · GHSA-pcvx-8r6m-5h8r

LOW 24

CISA Thorium does not escape user controlled strings used in LDAP queries.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.0031 Published 2025-09-17 Fixed in 1.1.1 CWE-90