CVE-2025-62717 Emlog Pro session verification code error due to clearing logic error

Low 2.7 Published 24 Oct 2025 Updated 24 Oct 2025

Attackers can reuse email verification codes due to a clearing logic error, potentially bypassing authentication in Emlog Pro.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-62717?

CVE-2025-62717 is a low-severity authentication bypass vulnerability in Emlog Emlog, published on 24 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Emlog is an open source website building system. In version 2.5.23, Emlog Pro is vulnerable to a session verification code error due to a clearing logic error. This means the verification code could be reused anywhere an email verification code is required. This issue has been fixed in commit 1f726df.

Weakness: CWE-287

Which versions are affected by CVE-2025-62717?

It affects 1 product.

Products include Emlog Emlog.

How do I fix CVE-2025-62717?

No fix has been published for CVE-2025-62717 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2025-62717 being exploited?

There is no known exploitation of CVE-2025-62717 in the wild and no public exploit code.

All Emlog Emlog vulnerabilities

Sources

Also known as GHSA-wwj4-ppfj-hcm6.