What’s Vulnerable › Vulnerabilities

CVE-2025-59841: FlagForgeCTF's Improper Session Handling Allows Access After Logout

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-09-25 · updated 2026-10-11
• Weakness: CWE-384

Description

Flag Forge is a Capture The Flag (CTF) platform. In versions from 2.2.0 to before 2.3.1, the FlagForge web application improperly handles session invalidation. Authenticated users can continue to access protected endpoints, such as /api/profile, even after logging out. CSRF tokens are also still valid post-logout, which can allow unauthorized actions. This issue has been patched in version 2.3.1.

Affected products

• FlagForgeCTF flagForge: from 2.2 before 2.3.1 — fixed in 2.3.1

How to fix

Upgrade to a fixed version: FlagForgeCTF flagForge 2.3.1. Check the vendor advisory for mitigations.

References

• https://github.com/FlagForgeCTF/flagForge/commit/304b6c82a4f76871b336404b91e5cdd8a7d7d5bd
• https://github.com/FlagForgeCTF/flagForge/security/advisories/GHSA-h6pr-4cwv-6cjg

Get alerted when CVE-2025-59841 or the next vulnerability affects your stack