# CVE-2025-66289: OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the application does not…

Source: https://junglewise.ai/threats/cve-2025-66289-orangehrm-is-a-comprehensive-human-resource-management-hrm-system  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-11-29  
License: CC BY 4.0 with a link back

CVE-2025-66289 · Severity: high · CVSS 8.8 · Published 2025-11-29

OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the application does not invalidate existing sessions when a user is disabled or when a password change occurs, allowing active session cookies to remain valid indefinitely. As a result, a disabled user, or an attacker using a compromised account, can continue to access protected pages and perform operations as long as a prior session remains active. Because the server performs no session revocation or session-store cleanup during these critical state changes, disabling an account or updating credentials has no effect on already-established sessions. This makes administrative disable actions ineffective and allows unauthorized users to retain full access even after an account is closed or a password is reset, exposing the system to prolonged unauthorized use and significantly increasing the impact of account takeover scenarios. This issue has been patched in version 5.8.

Technologies: [Orangehrm](https://junglewise.ai/threats/technologies/orangehrm). Vendors: [Orangehrm](https://junglewise.ai/threats/vendors/orangehrm).

## Quick answers

**Is CVE-2025-66289 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-66289 being exploited in the wild.

**How severe is CVE-2025-66289?** High severity, with a CVSS score of 8.8, published 29 November 2025.

**Which products and versions are affected?** Orangehrm. The advisory does not name versions.

**Is there a fix for CVE-2025-66289?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2025-66289?** Check whether you run Orangehrm. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Orangehrm

## Related threats

- [OrangeHRM inadequate encryption strength in sensitive fields](https://junglewise.ai/threats/cve-2026-39349-orangehrm-inadequate-encryption-strength-in-sensitive-fields)
- [OrangeHRM missing authorization in attachment download handlers](https://junglewise.ai/threats/cve-2026-39348-orangehrm-missing-authorization-in-attachment-download-handlers)
- [OrangeHRM improper authorization in self-appraisal submissions](https://junglewise.ai/threats/cve-2026-39347-orangehrm-improper-authorization-in-self-appraisal-submissions)
- [OrangeHRM Open Source access control bypass in disabled modules](https://junglewise.ai/threats/cve-2026-39346-orangehrm-open-source-access-control-bypass-in-disabled-modules)
- [OrangeHRM path traversal in email template loader](https://junglewise.ai/threats/cve-2026-39345-orangehrm-path-traversal-in-email-template-loader)