What’s Vulnerable › Vulnerabilities

CVE-2025-53102: Discourse's WebAuthn challenge isn't cleared from user session after authentication

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-07-29 · updated 2026-06-17
• Weakness: CWE-384

Description

Discourse is an open-source community discussion platform. Prior to version 3.4.7 on the `stable` branch and version 3.5.0.beta.8 on the `tests-passed` branch, upon issuing a physical security key for 2FA, the server generates a WebAuthn challenge, which the client signs. The challenge is not cleared from the user’s session after authentication, potentially allowing reuse and increasing security risk. This is fixed in versions 3.4.7 and 3.5.0.beta.8.

Affected products

• discourse: before 3.4.6; through 3.5.0; 3.5.0-beta1, 3.5.0-beta2, 3.5.0-beta3, 3.5.0-beta4, 3.5.0-beta5, 3.5.0-beta6 (+1) — fixed in 3.4.6

How to fix

Upgrade to a fixed version: discourse 3.4.6. Check the vendor advisory for mitigations.

References

• https://github.com/discourse/discourse/commit/20bf65099bb861a141bc10e8a4eab65329d91802
• https://github.com/discourse/discourse/commit/8bc0cee2c00a514ea60f33ea6172da2ce5a05beb
• https://github.com/discourse/discourse/security/advisories/GHSA-hv49-93h5-4wcv

Get alerted when CVE-2025-53102 or the next vulnerability affects your stack