PT-2025-50876 · Unknown · Groupsession Bycloud+2

Published 2025-12-12 · Updated 2026-02-17 · CVE-2025-61987

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions GroupSession versions prior to 5.3.0 GroupSession byCloud versions prior to 5.3.3 GroupSession ZION versions prior to 5.3.2

Description The software does not properly validate origins in WebSockets. If a user accesses a specially crafted webpage, chat information intended for the user may be disclosed.

Recommendations Update GroupSession to version 5.3.0 or later. Update GroupSession byCloud to version 5.3.3 or later. Update GroupSession ZION to version 5.3.2 or later.

Fix

Weakness Enumeration

CWE-1385

Related Identifiers

CVE-2025-61987

Affected Products

Groupsession

Groupsession Zion

Groupsession Bycloud

References · 7

• https://groupsession.jp/info/info-news/security20251208 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-61987 · Security Note
• https://osv.dev/vulnerability/CVE-2025-61987 · Vendor Advisory
• https://jvn.jp/en/jp/JVN19940619 · Note
• https://t.me/cveNotify/152197 · Telegram Post
• https://t.me/CVEtracker/39577 · Telegram Post
• https://t.me/cveNotify/145553 · Telegram Post