CVE-2025-53102
BaseFortify
Publication date: 2025-07-29
Last updated on: 2025-08-25
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| discourse | discourse | to 3.4.6 (exc) |
| discourse | discourse | to 3.5.0 (inc) |
| discourse | discourse | 3.5.0 |
| discourse | discourse | 3.5.0 |
| discourse | discourse | 3.5.0 |
| discourse | discourse | 3.5.0 |
| discourse | discourse | 3.5.0 |
| discourse | discourse | 3.5.0 |
| discourse | discourse | 3.5.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-384 | Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Discourse's WebAuthn implementation occurs because the server does not clear the WebAuthn challenge from the user's session after successful two-factor authentication using a physical security key. This means the challenge can be reused by an attacker, increasing the risk of unauthorized access through replay attacks. The issue affects Discourse versions stable ≤ 3.4.6 and tests-passed ≤ 3.5.0.beta7-dev and is fixed in later versions by clearing the challenge immediately after authentication and adding a 5-minute expiry to challenges. [1, 2, 3]
How can this vulnerability impact me? :
The vulnerability can impact you by allowing an attacker to reuse a previously valid WebAuthn challenge to gain unauthorized access to your Discourse account or system. This increases the risk to confidentiality, as attackers might bypass two-factor authentication protections without needing user interaction or privileges. The attack requires network access and has high complexity but can lead to significant security breaches if exploited. [1]
What immediate steps should I take to mitigate this vulnerability?
To mitigate CVE-2025-53102, immediately upgrade Discourse to version 3.4.7 or later on the stable branch, or to version 3.5.0.beta.8 or later on the tests-passed branch. These versions include the fix that clears the WebAuthn challenge from the user's session immediately after successful authentication, preventing challenge reuse and replay attacks. No workarounds are provided, so upgrading is the recommended immediate action. [1]