{"id":"CVE-2025-59841","title":"Flag Forge is a Capture The Flag (CTF) platform","summary":"Flag Forge is a Capture The Flag (CTF) platform. In versions from 2.2.0 to before 2.3.1, the FlagForge web application improperly handles session invalidation. Authenticated users can continue to access protected endpoints, such as /api/…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-384","CWE-613"],"vendor":"flagforge","product":"flagforge","affected":["flagforge >= 2.2, < 2.3.1"],"patched":["flagforge 2.3.1"],"published":"2025-09-25","updated":"2026-10-11","sourceUpdated":"2026-10-11T20:10:00.200","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-59841","references":[{"url":"https://github.com/FlagForgeCTF/flagForge/commit/304b6c82a4f76871b336404b91e5cdd8a7d7d5bd","label":"security-advisories@github.com"},{"url":"https://github.com/FlagForgeCTF/flagForge/security/advisories/GHSA-h6pr-4cwv-6cjg","label":"security-advisories@github.com"}],"tags":["nvd"],"epss":0.00423,"epssPercentile":0.34705,"ingestedAt":"2026-10-12T14:50:33.995Z","slug":"CVE-2025-59841","body":"## Overview\n\nFlag Forge is a Capture The Flag (CTF) platform. In versions from 2.2.0 to before 2.3.1, the FlagForge web application improperly handles session invalidation. Authenticated users can continue to access protected endpoints, such as /api/profile, even after logging out. CSRF tokens are also still valid post-logout, which can allow unauthorized actions. This issue has been patched in version 2.3.1.\n\n## Affected\n\n- `flagforge >= 2.2, < 2.3.1`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `flagforge 2.3.1`","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}