Unrated severityNVD Advisory· Published Sep 25, 2025· Updated Sep 29, 2025
FlagForgeCTF's Improper Session Handling Allows Access After Logout
CVE-2025-59841
Description
Flag Forge is a Capture The Flag (CTF) platform. In versions from 2.2.0 to before 2.3.1, the FlagForge web application improperly handles session invalidation. Authenticated users can continue to access protected endpoints, such as /api/profile, even after logging out. CSRF tokens are also still valid post-logout, which can allow unauthorized actions. This issue has been patched in version 2.3.1.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2>=2.2.0 <2.3.1+ 1 more
- (no CPE)range: >=2.2.0 <2.3.1
- (no CPE)range: >= 2.2.0, < 2.3.1
Patches
Vulnerability mechanics
References
2- github.com/FlagForgeCTF/flagForge/commit/304b6c82a4f76871b336404b91e5cdd8a7d7d5bdmitrex_refsource_MISC
- github.com/FlagForgeCTF/flagForge/security/advisories/GHSA-h6pr-4cwv-6cjgmitrex_refsource_CONFIRM
News mentions
0No linked articles in our index yet.