Unrated severityNVD Advisory· Published Sep 17, 2025· Updated Sep 30, 2025
CISA Thorium does not properly invalidate previously used tokens
CVE-2025-35433
Description
CISA Thorium does not properly invalidate previously used tokens when resetting passwords. An attacker that possesses a previously used token could still log in after a password reset. Fixed in 1.1.1.
Affected products
2- CISA/Thoriumv5Range: 1.0.0
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
4News mentions
0No linked articles in our index yet.