# CVE-2025-56643: Requarks Wiki.js 2.5.307 does not properly revoke or invalidate active JWT tokens when a user logs out. As a result…

Source: https://junglewise.ai/threats/cve-2025-56643-requarks-wiki-js-2-5-307-does-not-properly-revoke-or-invalidate  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-11-18  
License: CC BY 4.0 with a link back

CVE-2025-56643 · Severity: critical · CVSS 9.1 · Published 2025-11-18

Requarks Wiki.js 2.5.307 does not properly revoke or invalidate active JWT tokens when a user logs out. As a result, previously issued tokens remain valid and can be reused to access the system, even after logout. This behavior affects session integrity and may allow unauthorized access if a token is compromised. The issue is present in the authentication resolver logic and affects both the GraphQL endpoint and the logout mechanism.

Technologies: [Requarks Wiki.js](https://junglewise.ai/threats/technologies/wiki-js). Vendors: [Requarks](https://junglewise.ai/threats/vendors/requarks).

## Quick answers

**Is CVE-2025-56643 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-56643 being exploited in the wild.

**How severe is CVE-2025-56643?** Critical severity, with a CVSS score of 9.1, published 18 November 2025.

**Which products and versions are affected?** Requarks Wiki.js. The advisory does not name versions.

**Is there a fix for CVE-2025-56643?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2025-56643?** Check whether you run Requarks Wiki.js. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Requarks Wiki.js

## Related threats

- [Wiki.js path permission bypass in page rule engine](https://junglewise.ai/threats/cve-2026-92776-wiki-js-path-permission-bypass-in-page-rule-engine)
- [Wiki.js Image Prefetch server-side request forgery](https://junglewise.ai/threats/cve-2026-92775-wiki-js-image-prefetch-server-side-request-forgery)
- [Wiki.js authorization bypass in GraphQL resolvers via tag omission](https://junglewise.ai/threats/cve-2026-92774-wiki-js-authorization-bypass-in-graphql-resolvers-via-tag)
- [Requarks Wiki.js privilege escalation in users.update GraphQL mutation](https://junglewise.ai/threats/cve-2026-44224-requarks-wiki-js-privilege-escalation-in-users-update-graphql)