https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 13:16:20 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-222193 EUVD-2026-222193 https://cve.radiocsirt.org/vuln/euvd-2026-222193 https://cve.radiocsirt.org/vuln/fkie_cve-2025-27794 <p>Flarum is open-source forum software. A session hijacking vulnerability exists in versions prior to 1.8.10 when an attacker-controlled authoritative subdomain under a parent domain (e.g., `subdomain.host.com`) sets cookies scoped to the parent domain (`.host.com`). This allows session token replacement for applications hosted on sibling subdomains (e.g., `community.host.com`) if session tokens aren&#39;t rotated post-authentication. Key Constraints are that the attacker must control any subdomain under the parent domain (e.g., `evil.host.com` or `x.y.host.com`), and the parent domain must not be on the Public Suffix List. Due to non-existent session token rotation after authenticating we can theoretically reproduce the vulnerability by using browser dev tools, but due to the browser&#39;s security measures this does not seem to be exploitable as described. Version 1.8.10 contains a patch for the issue.</p> <p>Flarum is open-source forum software. A session hijacking vulnerability exists in versions prior to 1.8.10 when an attacker-controlled authoritative subdomain under a parent domain (e.g., `subdomain.host.com`) sets cookies scoped to the parent domain (`.host.com`). This allows session token replacement for applications hosted on sibling subdomains (e.g., `community.host.com`) if session tokens aren&#39;t rotated post-authentication. Key Constraints are that the attacker must control any subdomain under the parent domain (e.g., `evil.host.com` or `x.y.host.com`), and the parent domain must not be on the Public Suffix List. Due to non-existent session token rotation after authenticating we can theoretically reproduce the vulnerability by using browser dev tools, but due to the browser&#39;s security measures this does not seem to be exploitable as described. Version 1.8.10 contains a patch for the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-27794 https://cve.radiocsirt.org/vuln/ghsa-hg9j-64wp-m9px <p><strong>Affected:</strong> Packagist: flarum/core, Packagist: flarum/framework</p> <p>## **Summary** A session hijacking vulnerability exists when an attacker-controlled **authoritative subdomain** under a parent domain (e.g., `subdomain.host.com`) sets cookies scoped to the parent domain (`.host.com`). This allows session token replacement for applications hosted on sibling subdomains (e.g., `community.host.com`) if session tokens aren&#39;t rotated post-authentication.</p> <p>**Key Constraints**: - Attacker must control **any subdomain** under the parent domain (e.g., `evil.host.com` or `x.y.host.com`). - Parent domain must **not** be on the [Public Suffix List](https://publicsuffix.org/).</p> <p>Due to non-existent session token rotation after authenticating we can theoretically reproduce the vulnerability by using browser dev tools, but due to the browser&#39;s security measures this does not seem to be exploitable as described.</p> <p>---</p> <p>## **Proof of Concept (Deno)** ```ts Deno.serve({ port: 8000, // default hostname: &#39;localhost&#39;, onListen: (o) =&gt; console.log(`Server started at http://${o.hostname}:${o.port}`, o), }, async (req) =&gt; (console.log(req), new Response( `You&#39;ve been served! You came from ${req.headers.get(&#39;referer&#39;)}`, { //status: 302, // would redirect user to page they came from status: 200, headers: { &#39;set-cookie&#39;: &#39;session_cookie=mytoken; Domain=.deno.dev; Secure; HttpOnly&#39;, &#39;location&#39;: req.headers.get(&#39;referer&#39;) } } )) ); ```</p> <p>### **Attack Flow** 1. **Attacker Setup**: Hosts serve…</p> <p><strong>Affected:</strong> Packagist: flarum/core, Packagist: flarum/framework</p> <p>## **Summary** A session hijacking vulnerability exists when an attacker-controlled **authoritative subdomain** under a parent domain (e.g., `subdomain.host.com`) sets cookies scoped to the parent domain (`.host.com`). This allows session token replacement for applications hosted on sibling subdomains (e.g., `community.host.com`) if session tokens aren&#39;t rotated post-authentication.</p> <p>**Key Constraints**: - Attacker must control **any subdomain** under the parent domain (e.g., `evil.host.com` or `x.y.host.com`). - Parent domain must **not** be on the [Public Suffix List](https://publicsuffix.org/).</p> <p>Due to non-existent session token rotation after authenticating we can theoretically reproduce the vulnerability by using browser dev tools, but due to the browser&#39;s security measures this does not seem to be exploitable as described.</p> <p>---</p> <p>## **Proof of Concept (Deno)** ```ts Deno.serve({ port: 8000, // default hostname: &#39;localhost&#39;, onListen: (o) =&gt; console.log(`Server started at http://${o.hostname}:${o.port}`, o), }, async (req) =&gt; (console.log(req), new Response( `You&#39;ve been served! You came from ${req.headers.get(&#39;referer&#39;)}`, { //status: 302, // would redirect user to page they came from status: 200, headers: { &#39;set-cookie&#39;: &#39;session_cookie=mytoken; Domain=.deno.dev; Secure; HttpOnly&#39;, &#39;location&#39;: req.headers.get(&#39;referer&#39;) } } )) ); ```</p> <p>### **Attack Flow** 1. **Attacker Setup**: Hosts serve…</p> https://cve.radiocsirt.org/vuln/ghsa-hg9j-64wp-m9px