GHSA-HG9J-64WP-M9PX Flarum Vulnerable to Session Hijacking via Authoritative Subdomain Cookie Overwrite

Summary A session hijacking vulnerability exists when an attacker-controlled authoritative subdomain under a parent domain e.g., subdomain.host.com sets cookies scoped to the parent domain .host.com. This allows session token replacement for applications hosted on sibling subdomains e.g.,...

CVE-2025-27794

Summary: CVE-2025-27794 affects Flarum versions prior to 1.8.10, where an attacker-controlled authoritative subdomain can set cookies for the parent domain, potentially enabling session hijacking on sibling subdomains. What is affected: Flarum core (pre-1.8.10) with cookies scoped to a parent dom...

CVE-2025-27794: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Flarum is open-source forum software. A session hijacking vulnerability exists in versions prior to 1.8.10 when an attacker-controlled authoritative subdomain under a parent domain e.g., subdomain.host.com sets cookies scoped to the parent domain .host.com. This allows session token replacement f...