CVE-2025-11699 CVE-2025-11699

High 7.1 Published 1 Dec 2025 Updated 1 Dec 2025

Attackers can hijack sessions and access admin endpoints after logout due to missing session invalidation in nopCommerce.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2025-11699?

CVE-2025-11699 is a high-severity authentication bypass vulnerability in nopSolutions nopCommerce, published on 1 Dec 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

nopCommerce v4.70 and prior, and version 4.80.3, does not invalidate session cookies after logout or session termination, allowing an attacker who has a a valid session cookie access to privileged endpoints (such as /admin) even after the legitimate user has logged out, enabling session hijacking. Any version above 4.70 that is not 4.80.3 fixes the vulnerability.

Weakness: CWE-613

Which versions are affected by CVE-2025-11699?

It affects 1 product.

Products include Nopcommerce Nopcommerce.

How do I fix CVE-2025-11699?

No fix has been published for CVE-2025-11699 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2025-11699 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-11699 exists.

Sources

Also known as GHSA-hgx3-j7fm-pjm3.