CVE-2025-27794 Flarum Vulnerable to Session Hijacking via Authoritative Subdomain Cookie Overwrite
Attackers controlling a sibling subdomain can hijack user sessions in Flarum by overwriting parent-domain cookies, leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-27794?
CVE-2025-27794 is a medium-severity authentication bypass vulnerability in flarum framework, published on 12 Mar 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Flarum is open-source forum software. A session hijacking vulnerability exists in versions prior to 1.8.10 when an attacker-controlled authoritative subdomain under a parent domain (e.g., `subdomain.host.com`) sets cookies scoped to the parent domain (`.host.com`). This allows session token replacement for applications hosted on sibling subdomains (e.g., `community.host.com`) if session tokens aren't rotated post-authentication. Key Constraints are that the attacker must control any subdomain under the parent domain (e.g., `evil.host.com` or `x.y.host.com`), and the parent domain must not be on the Public Suffix List. Due to non-existent session token rotation after authenticating we can theoretically reproduce the vulnerability by using browser dev tools, but due to the browser's security measures this does not seem to be exploitable as described. Version 1.8.10 contains a patch for the issue.
Weakness: CWE-74
Which versions are affected by CVE-2025-27794?
4 open source packages ship an affected version, including flarum/framework and flarum/core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
flarum/framework Packagist | All versions | 1.8.10 |
flarum/framework Packagist | All versions | 1.8.10 |
flarum/core Packagist | All versions | 1.8.10 |
flarum/core Packagist | All versions | 1.8.10 |
Products include Flarum Flarum.
How do I fix CVE-2025-27794?
Upgrade flarum/framework to 1.8.10 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-27794 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-27794 exists.
Other vulnerabilities in flarum framework
- CVE-2021-32671 XSS vulnerability with translator
- CVE-2022-41938 Cross site scripting vulnerability with discussion titles in flarum
- CVE-2019-13183 Cross-site request forgery in n/a
- CVE-2023-22487 Post mentions can be used to read any post on the forum without access control
- CVE-2019-11514 Flarum mishandles invalidation of user email tokens
Sources
Also known as GHSA-hg9j-64wp-m9px.