BaseFortify

Publication date: 2025-11-29

Last updated on: 2025-12-02

Assigner: GitHub, Inc.

Description

Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, a bug in Kiteworks MFT could cause under certain circumstances that a user's active session would not properly time out due to inactivity. This issue has been patched in version 9.1.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-29

Last Modified

2025-12-02

Generated

2026-07-06

AI Q&A

2025-11-29

EPSS Evaluated

2026-07-05

NVD

CVE-2025-53896

Affected Vendors & Products

Vendor	Product	Version / Range
accellion	kiteworks_managed_file_transfer	to 9.1.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-613	According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Attack-Flow Graph

Executive Summary

This vulnerability in Kiteworks MFT prior to version 9.1.0 is a bug where a user's active session might not properly time out due to inactivity under certain circumstances. This means that sessions could remain active longer than intended, potentially allowing unauthorized access.

Impact Analysis

Because the user's session may not time out properly, an attacker with access to an active session could maintain access without re-authentication, potentially leading to unauthorized access to sensitive files or data within the Kiteworks MFT system.

Mitigation Strategies

Upgrade Kiteworks MFT to version 9.1.0 or later, as this version contains the patch that fixes the session timeout issue.

Hi! I’m here to help you understand CVE-2025-53896. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70