PT-2025-31259 · Discourse · Discourse

Published 2025-07-29 · Updated 2025-08-11 · CVE-2025-53102

Positive Technologies (AI Summary)

CVSS v4.0

8.2

High

Base vector

AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 3.4.7 on the stable branch Discourse versions prior to 3.5.0.beta.8 on the tests-passed branch

Description Discourse is an open-source community discussion platform. Upon issuing a physical security key for two-factor authentication (2FA), the server generates a WebAuthn challenge, which the client signs. The challenge is not cleared from the user’s session after authentication, potentially allowing reuse and increasing security risk.

Recommendations Update Discourse to version 3.4.7 on the stable branch. Update Discourse to version 3.5.0.beta.8 on the tests-passed branch.

Exploit

Fix

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

BIT-DISCOURSE-2025-53102

CVE-2025-53102

GHSA-HV49-93H5-4WCV

Affected Products

Discourse

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53102.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-53102 · Security Note
• https://osv.dev/vulnerability/BIT-discourse-2025-53102 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-53102 · Vendor Advisory
• https://github.com/discourse/discourse/commit/20bf65099bb861a141bc10e8a4eab65329d91802 · Note
• https://github.com/discourse/discourse/security/advisories/GHSA-hv49-93h5-4wcv · Note
• https://github.com/discourse/discourse/commit/8bc0cee2c00a514ea60f33ea6172da2ce5a05beb · Note
• https://twitter.com/CVEnew/status/1950280456093528537 · Twitter Post
• https://twitter.com/Hossted_OSS/status/1954794306595647990 · Twitter Post
• https://t.me/CVEtracker/28703 · Telegram Post