CVE-2025-66289
BaseFortify
Publication date: 2025-11-29
Last updated on: 2025-12-03
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| orangehrm | orangehrm | From 5.0 (inc) to 5.8 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-613 | According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization." |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in OrangeHRM versions 5.0 to 5.7 occurs because the application does not invalidate existing user sessions when a user is disabled or when their password is changed. As a result, session cookies from active sessions remain valid indefinitely, allowing disabled users or attackers with compromised accounts to continue accessing protected pages and performing operations. The server does not revoke sessions or clean up session stores during these critical changes, making administrative disable actions ineffective and enabling unauthorized access even after account closure or password reset. This issue was fixed in version 5.8.
How can this vulnerability impact me? :
This vulnerability can lead to prolonged unauthorized access to the OrangeHRM system. An attacker or a disabled user can continue to use an active session to access sensitive information and perform operations despite account disablement or password changes. This increases the risk and impact of account takeover scenarios, potentially exposing sensitive HR data and administrative functions to unauthorized users.
What immediate steps should I take to mitigate this vulnerability?
Upgrade OrangeHRM to version 5.8 or later, as this version includes a patch that invalidates existing sessions when a user is disabled or a password is changed, preventing active session cookies from remaining valid indefinitely.