Executive brief
Flarum Vulnerable to Session Hijacking via Authoritative Subdomain Cookie Overwrite
Affected products
- Packagist flarum/framework
- Packagist flarum/core
Junglewise Threat Intelligence
CVE-2025-27794: Flarum Vulnerable to Session Hijacking via Authoritative Subdomain Cookie Overwrite
CVE-2025-27794 · Severity: low · CVSS 3.1 · Published 2025-03-12
Technologies: flarum/framework (Packagist), flarum/core (Packagist). Vendors: Packagist.
Related threats
- Flarum's logout Route allows open redirects
- Flarum vulnerable to LFI and Blind SSRF via Avatar upload
- Path Traversal Vulnerability in `LESS` Parser allows reading of sensitive server files
- Any Flarum user including unactivated can reply in public discussions whose first post was permanently deleted
- Flarum notifications can leak restricted content