CVE-2025-53102
Published: 29 July 2025
Summary
CVE-2025-53102 is a high-severity Session Fixation (CWE-384) vulnerability in Discourse Discourse. Its CVSS base score is 8.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Multi-Factor Authentication Interception (T1111); ranked in the top 48.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-23042
Vulnerability details
Discourse is an open-source community discussion platform. Prior to version 3.4.7 on the `stable` branch and version 3.5.0.beta.8 on the `tests-passed` branch, upon issuing a physical security key for 2FA, the server generates a WebAuthn challenge, which the client signs.…
more
The challenge is not cleared from the user’s session after authentication, potentially allowing reuse and increasing security risk. This is fixed in versions 3.4.7 and 3.5.0.beta.8.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability enables reuse/replay of WebAuthn 2FA challenges not cleared from user sessions (T1111: Multi-Factor Authentication Interception). Exists in public-facing web application Discourse, remotely exploitable without privileges (T1190: Exploit Public-Facing Application).
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Session termination after a set interval shortens the usable lifetime of a fixed session identifier, making successful exploitation of session fixation more difficult.
Re-authentication typically forces issuance of a new session, limiting the window for exploitation of a previously fixed session identifier.
Enforces proper session ID generation and binding, preventing fixation of a known session token.