Critical severity · published Jul 29, 2025
CVE-2025-53102
Discourse's WebAuthn challenge isn't cleared from user session after authentication
9.8
CVSS
0.5%
EPSS
No
On KEV
Description
Discourse is an open-source community discussion platform. Prior to version 3.4.7 on the `stable` branch and version 3.5.0.beta.8 on the `tests-passed` branch, upon issuing a physical security key for 2FA, the server generates a WebAuthn challenge, which the client signs. The challenge is not cleared from the user’s session after authentication, potentially allowing reuse and increasing security risk. This is fixed in versions 3.4.7 and 3.5.0.beta.8.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DI
discourse · discourse
>= 3.5.0.beta1, < 3.5.0.beta.8; < 3.4.7 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-53102
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-53102
Patch
https://github.com/discourse/discourse/commit/20bf65099bb861a141bc10e8a4eab65329d91802
Patch
https://github.com/discourse/discourse/commit/8bc0cee2c00a514ea60f33ea6172da2ce5a05beb
Third Party Advisory
https://github.com/discourse/discourse/security/advisories/GHSA-hv49-93h5-4wcv
More from discourse
9.9
CVE-2025-68662
FinalDestination hostname matching allows SSRF protection bypass
9.8
CVE-2025-48877
Discourse vulnerable to auto-executing of third-party code in embedded CodePen iframe
9.8
CVE-2023-47121
Discourse is an open source platform for community discussion
9.8
CVE-2021-41163
Discourse is an open source platform for community discussion
9.3
CVE-2026-55674
Discourse: Cache poisoning/XSS via color scheme cookies