CVE-2025-61987 Cross-site request forgery in GroupSession Free edition
Attackers can expose chat information by tricking users into visiting crafted pages due to missing WebSocket origin validation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-61987?
CVE-2025-61987 is a medium-severity vulnerability in Japan Total System Co.,Ltd. GroupSession Free edition, published on 12 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, and GroupSession ZION prior to ver5.3.2. do not validate origins in WebSockets. If a user accesses a crafted page, Chat information sent to the user may be exposed.
Weakness: CWE-1385
Which versions are affected by CVE-2025-61987?
It affects 1 product.
Products include Groupsession Groupsession.
How do I fix CVE-2025-61987?
No fix has been published for CVE-2025-61987 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-61987 being exploited?
There is no known exploitation of CVE-2025-61987 in the wild and no public exploit code.
Other vulnerabilities in Japan Total System Co.,Ltd. GroupSession Free edition
- CVE-2021-20874 Missing authorization in GroupSession Free edition, GroupSession byCloud, GroupSession ZION
- CVE-2021-20876 Path traversal in GroupSession Free edition, GroupSession byCloud, GroupSession ZION
- CVE-2017-2165 Information disclosure in GroupSession
- CVE-2021-20875 Open redirect in GroupSession Free edition, GroupSession byCloud, GroupSession ZION
- CVE-2021-20789 Open redirect in GroupSession
Sources
Also known as GHSA-r3gq-2jpg-6v2w.