Critical severity9.8NVD Advisory· Published Jan 3, 2022· Updated Jun 17, 2026

CVE-2021-25981

Description

In Talkyard, regular versions v0.2021.20 through v0.2021.33 and dev versions v0.2021.20 through v0.2021.34, are vulnerable to Insufficient Session Expiration. This may allow an attacker to reuse the admin’s still-valid session token even when logged-out, to gain admin privileges, given the attacker is able to obtain that token (via other, hypothetical attacks)

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

debiki/Talkyardllm-fuzzy2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: v0.2021.20
Talkyard/Talkyardllm-create2 versions
v0.2021.20 through v0.2021.33, v0.2021.20 through v0.2021.34+ 1 more
- (no CPE)range: v0.2021.20 through v0.2021.33, v0.2021.20 through v0.2021.34
- cpe:2.3:a:talkyard:talkyard:*:*:*:*:*:*:*:*range: >=0.2021.20,<0.2021.35

Patches

Vulnerability mechanics

References

github.com/debiki/talkyard/commit/b0310df019887f3464895529c773bc7d85ddcf34nvdPatchThird Party Advisory
github.com/debiki/talkyard/commit/b0712915d8a22a20b09a129924e8a29c25ae5761nvdPatchThird Party Advisory
www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25981nvdPatchThird Party AdvisoryVDB Entry

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.002
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000