PT-2025-47368 · Wiki.Js · Wiki.Js

Published 2025-11-06 · Updated 2025-11-19 · CVE-2025-56643

Positive Technologies (AI Summary)

CVSS v3.1

9.4

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Wiki.js version 2.5.307

Description Wiki.js does not properly revoke or invalidate active JWT tokens when a user logs out. This allows previously issued tokens to remain valid and be reused to access the system, even after logout. The issue impacts session integrity and could allow unauthorized access if a token is compromised. The problem exists in the authentication resolver logic, affecting the GraphQL endpoint and the logout mechanism.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Exploit

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

BDU:2026-00043

CVE-2025-56643

Affected Products

Wiki.Js

References · 5

• 🔥 https://github.com/0xBS0D27/CVE-2025-56643 · Exploit
• https://osv.dev/vulnerability/CVE-2025-56643 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-00043 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-56643 · Security Note
• https://twitter.com/CVEnew/status/1991042999833202734 · Twitter Post