CVE-2025-46743

The vulnerability stems from a flaw in how SEL software handles authentication tokens. When a user logs out, the corresponding token is not immediately invalidated; instead, it remains valid until its natural expiration time. This allows a token that was captured prior to logout to be reused by another source.

Exploitation requires an attacker to have previously intercepted or obtained a valid token, such as through network sniffing, before the legitimate user logs out. No additional authentication is needed if the token is reused within its validity window. The attack can be performed from any network position that can access the affected service.

A successful attack enables an unauthorized actor to impersonate the logged-out user, gaining the same level of access to the SEL system. This could lead to unauthorized viewing or modification of system configurations, potentially impacting operational security.

SEL has addressed this issue in the latest software versions listed on their website [1]. Users are advised to update to the patched version to prevent token reuse. No workarounds have been provided for unpatched versions.