CVE-2025-24973
Raw vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2025-24973 is a critical-severity Insufficient Session Expiration (CWE-613) vulnerability. Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Browser Session Hijacking (T1185); ranked at the 8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-12 (Session Termination) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-24973 is a high-severity authentication vulnerability (CVSS 9.3, CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) stemming from an improper implementation of the logout process in Concorde, a federated microblogging platform forked from Misskey and formerly known as Nexkey. In versions prior to 12.25Q1.1, authentication credentials persist in browser cookies even after a user explicitly logs out, enabling potential theft of these tokens. The issue is classified under CWE-613 (Insufficient Session Expiration).
A local attacker with access to a shared device can exploit this vulnerability by accessing the victim's browser cookies after logout, stealing the authentication tokens without requiring privileges or user interaction. Successful exploitation allows the attacker to impersonate the victim, potentially gaining complete control over the account (high confidentiality, integrity, and availability impact with changed scope). This is particularly severe if the victim holds admin privileges on a shared device, as it could lead to full platform compromise.
The Concorde security advisory (GHSA-2369-p2wh-7cc2) and fixing commit (1f6ac9b289906083b132e4f9667a31a60ef83e4e) confirm that version 12.25Q1.1 resolves the issue. As mitigation, users should upgrade to the patched version; on shared devices, regenerate login tokens via Settings > Security. A workaround involves manually clearing cookies and site data in the browser after logging out.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3998
Vulnerability Data
Concorde, formerly know as Nexkey, is a fork of the federated microblogging platform Misskey. Prior to version 12.25Q1.1, due to an improper implementation of the logout process, authentication credentials remain in cookies even after a user has explicitly logged out,…
more
which may allow an attacker to steal authentication tokens. This could have devastating consequences if a user with admin privileges is (or was) using a shared device. Users who have logged in on a shared device should go to Settings > Security and regenerate their login tokens. Version 12.25Q1.1 fixes the issue. As a workaround, clear cookies and site data in the browser after logging out.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
AC-12 directly requires automatic session termination after a defined period, structurally preventing reuse of expired session identifiers.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Credential lifecycle management directly includes enforcing session expiration to prevent reuse.
Authorization policy enforcement and review covers terminating stale sessions to limit access scope.
Authentication mechanisms can incorporate session timeout checks but do not inherently address expiration policy.