Insufficient Session Expiration

Overview Affected versions of this package are vulnerable to Insufficient Session Expiration due to improper revocation of session tokens in the TokensClearer::clearPasswordTokens process. An attacker can maintain unauthorized access to an account by continuing to use a valid session token even...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' via authoritative subdomain cookie overwrite. An attacker controlling a subdomain under the parent domain can set cookies scoped to the...

CVE-2025-27794

creationtimestamp| type| source ---|---|--- 2025-03-12 10:22:26+00:00| published-proof-of-concept| https://github.com/flarum/framework/security/advisories/GHSA-hg9j-64wp-m9px...