CVE-2025-2596 LOW

CVE-2025-2596: Session logout can be overwritten by long lasting request

Vendor Checkmk Gmbh
Product Checkmk
Weakness CWE-613 · Insufficient session expiration
Published March 26, 2025
Last update March 26, 2025
View on NVD All CVEs

CVSS base score

2.3/10
Attack vector Network
Attack complexity High
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Session logout could be overwritten in Checkmk GmbH's Checkmk versions <2.3.0p30, <2.2.0p41, and 2.1.0p49 (EOL)

Key dates

02Disclosure timeline

March 26, 2025 CVE published
March 26, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2021-31408 Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19 CVE-2023-5865 Insufficient Session Expiration in thorsten/phpmyfaq CVE-2025-12624 Improper Token Invalidation in WSO2 Identity Server Allows Access After Account Lock CVE-2025-12110 Keycloak: org.keycloak:keycloak-services: user can refresh offline session even after client's offline_access scope was removed CVE-2021-25985 FactorJS - Insufficient Session Expiration Leads to a Local Account Takeover