Unrated severityNVD Advisory· Published Sep 25, 2025· Updated Sep 29, 2025
FlagForgeCTF's Improper Session Handling Allows Access After Logout
CVE-2025-59841
Description
Flag Forge is a Capture The Flag (CTF) platform. In versions from 2.2.0 to before 2.3.1, the FlagForge web application improperly handles session invalidation. Authenticated users can continue to access protected endpoints, such as /api/profile, even after logging out. CSRF tokens are also still valid post-logout, which can allow unauthorized actions. This issue has been patched in version 2.3.1.
Affected products
1- Range: >= 2.2.0, < 2.3.1
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
2- github.com/FlagForgeCTF/flagForge/commit/304b6c82a4f76871b336404b91e5cdd8a7d7d5bdmitrex_refsource_MISC
- github.com/FlagForgeCTF/flagForge/security/advisories/GHSA-h6pr-4cwv-6cjgmitrex_refsource_CONFIRM
News mentions
0No linked articles in our index yet.