CVE-2025-53102

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-53102
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-53102.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-53102
Aliases
Published
2025-07-29T19:24:06.076Z
Modified
2026-07-15T01:49:19.651110462Z
Severity
  • 8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Discourse's WebAuthn challenge isn't cleared from user session after authentication
Details

Discourse is an open-source community discussion platform. Prior to version 3.4.7 on the stable branch and version 3.5.0.beta.8 on the tests-passed branch, upon issuing a physical security key for 2FA, the server generates a WebAuthn challenge, which the client signs. The challenge is not cleared from the user’s session after authentication, potentially allowing reuse and increasing security risk. This is fixed in versions 3.4.7 and 3.5.0.beta.8.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53102.json",
    "cwe_ids": [
        "CWE-384"
    ],
    "cna_assigner": "GitHub_M",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "3.5.0.beta1"
                },
                {
                    "fixed": "3.5.0.beta.8"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/discourse/discourse

Affected ranges

Type
GIT
Repo
https://github.com/discourse/discourse
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
3d149ba8244585f4bcb41db77aa8825e72468bdb
Introduced
444127445694c2383248a5a98f437bded4b663f3
Fixed
20bf65099bb861a141bc10e8a4eab65329d91802
Fixed
8bc0cee2c00a514ea60f33ea6172da2ce5a05beb
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.4.6"
        },
        {
            "last_affected": "3.5.0"
        },
        {
            "introduced": "3.5.0-beta1"
        },
        {
            "last_affected": "3.5.0-beta1"
        },
        {
            "introduced": "3.5.0-beta2"
        },
        {
            "last_affected": "3.5.0-beta2"
        },
        {
            "introduced": "3.5.0-beta3"
        },
        {
            "last_affected": "3.5.0-beta3"
        },
        {
            "introduced": "3.5.0-beta4"
        },
        {
            "last_affected": "3.5.0-beta4"
        },
        {
            "introduced": "3.5.0-beta5"
        },
        {
            "last_affected": "3.5.0-beta5"
        },
        {
            "introduced": "3.5.0-beta6"
        },
        {
            "last_affected": "3.5.0-beta6"
        },
        {
            "introduced": "3.5.0-beta7"
        },
        {
            "last_affected": "3.5.0-beta7"
        }
    ],
    "cpe": [
        "cpe:2.3:a:discourse:discourse:*:*:*:*:stable:*:*:*",
        "cpe:2.3:a:discourse:discourse:*:*:*:*:beta:*:*:*",
        "cpe:2.3:a:discourse:discourse:3.5.0:beta1:*:*:beta:*:*:*",
        "cpe:2.3:a:discourse:discourse:3.5.0:beta2:*:*:beta:*:*:*",
        "cpe:2.3:a:discourse:discourse:3.5.0:beta3:*:*:beta:*:*:*",
        "cpe:2.3:a:discourse:discourse:3.5.0:beta4:*:*:beta:*:*:*",
        "cpe:2.3:a:discourse:discourse:3.5.0:beta5:*:*:beta:*:*:*",
        "cpe:2.3:a:discourse:discourse:3.5.0:beta6:*:*:beta:*:*:*",
        "cpe:2.3:a:discourse:discourse:3.5.0:beta7:*:*:beta:*:*:*"
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING",
        "REFERENCES"
    ]
}

Affected versions

3.*
3.5.0-beta1
3.5.0-beta2
3.5.0-beta3
3.5.0-beta4
3.5.0-beta5
3.5.0-beta6
3.5.0-beta7
v0.*
v0.8.0
v0.8.1
v0.8.2
v0.8.3
v0.8.4
v0.8.5
v0.8.6
v0.8.7
v0.8.8
v0.8.9
v0.9.0
v0.9.1
v0.9.2
v0.9.2.5
v0.9.2.6
v0.9.3
v0.9.4
v0.9.5
v0.9.5.1
v0.9.5.2
v0.9.6
v0.9.6.1
v0.9.6.3
v0.9.6.4
v0.9.7
v0.9.7.1
v0.9.7.2
v0.9.7.3
v0.9.7.4
v0.9.7.5
v0.9.7.6
v0.9.7.7
v0.9.7.8
v0.9.7.9
v0.9.8
v0.9.8.1
v0.9.8.10
v0.9.8.11
v0.9.8.2
v0.9.8.3
v0.9.8.4
v0.9.8.5
v0.9.8.6
v0.9.8.7
v0.9.8.8
v0.9.8.9
v0.9.9.1
v0.9.9.10
v0.9.9.11
v0.9.9.12
v0.9.9.13
v0.9.9.14
v0.9.9.15
v0.9.9.16
v0.9.9.17
v0.9.9.18
v0.9.9.2
v0.9.9.3
v0.9.9.4
v0.9.9.5
v0.9.9.6
v0.9.9.7
v0.9.9.8
v0.9.9.9
v1.*
v1.0.0
v1.0.1
v1.0.2
v1.0.3
v1.0.4
v1.1.0
v1.1.1
v1.1.2
v1.1.3
v1.2.0
v1.2.1
v1.2.2
v1.2.3
v1.2.4
v1.3.0
v1.3.1
v1.3.2
v1.3.3
v1.3.4
v1.3.5
v1.4.0
v1.4.1
v1.4.2
v1.4.3
v1.4.4
v1.4.5
v1.4.6
v1.4.7
v1.5.0
v1.5.1
v1.5.2
v1.5.3
v1.5.4
v1.6.0
v1.6.1
v1.6.10
v1.6.2
v1.6.3
v1.6.4
v1.6.5
v1.6.6
v1.6.7
v1.6.8
v1.6.9
v1.7.0
v1.7.1
v1.7.10
v1.7.2
v1.7.3
v1.7.4
v1.7.5
v1.7.6
v1.7.7
v1.7.8
v1.7.9
v1.8.0
v1.8.1
v1.8.10
v1.8.11
v1.8.2
v1.8.3
v1.8.4
v1.8.5
v1.8.6
v1.8.7
v1.8.8
v1.8.9
v1.9.0
v1.9.1
v1.9.2
v1.9.3
v1.9.4
v1.9.5
v1.9.6
v1.9.7
v2.*
v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.2
v2.1.3
v2.1.4
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.2.4
v2.2.5
v2.2.6
v2.3.0
v2.3.1
v2.3.10
v2.3.2
v2.3.3
v2.3.4
v2.3.5
v2.3.6
v2.3.7
v2.3.8
v2.3.9
v2.4.0
v2.4.1
v2.4.2
v2.4.3
v2.4.4
v2.4.5
v2.5.0
v2.5.1
v2.5.2
v2.5.3
v2.5.4
v2.5.5
v2.6.0
v2.6.1
v2.6.2
v2.6.3
v2.6.4
v2.6.5
v2.6.6
v2.6.7
v2.7.0
v2.7.1
v2.7.10
v2.7.11
v2.7.12
v2.7.13
v2.7.2
v2.7.3
v2.7.4
v2.7.5
v2.7.6
v2.7.7
v2.7.8
v2.7.9
v2.8.0
v2.8.1
v2.8.10
v2.8.11
v2.8.12
v2.8.13
v2.8.14
v2.8.2
v2.8.3
v2.8.4
v2.8.5
v2.8.6
v2.8.7
v2.8.8
v2.8.9
v3.*
v3.0.0
v3.0.1
v3.0.2
v3.0.3
v3.0.4
v3.0.5
v3.0.6
v3.1.0
v3.1.1
v3.1.2
v3.1.3
v3.1.4
v3.1.5
v3.2.0
v3.2.1
v3.2.2
v3.2.3
v3.2.4
v3.2.5
v3.3.0
v3.3.1
v3.3.2
v3.3.3
v3.3.4
v3.4.0
v3.4.1
v3.4.2
v3.4.3
v3.4.4
v3.4.5
v3.4.6
v3.5.0.beta1
v3.5.0.beta2
v3.5.0.beta3
v3.5.0.beta4
v3.5.0.beta5
v3.5.0.beta6
v3.5.0.beta7

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-53102.json"