CVE-2025-27794: Flarum Session Hijacking Vulnerability via Authoritative Subdomain Cookie Overwrite
Summary
CVE-2025-27794: Flarum Vulnerable to Session Hijacking via Authoritative Subdomain Cookie Overwrite. Affects flarum/core versions < 1.8.10. Fixed in 1.8.10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Flarum is a modern forum software that provides a simple and elegant interface for community discussions. It is designed to be lightweight and extensible, allowing users to customize their forum experience. However, Flarum is vulnerable to a session hijacking issue due to improper handling of cookies when hosted on subdomains, which can lead to unauthorized access to user accounts.
Vulnerability Detail
A session hijacking vulnerability exists when an attacker-controlled authoritative subdomain sets cookies scoped to the parent domain. This allows session token replacement for applications hosted on sibling subdomains if session tokens are not rotated post-authentication. The attacker must control any subdomain under the parent domain, and the parent domain must not be on the Public Suffix List. The lack of session token rotation after authentication makes this vulnerability particularly concerning, as it can lead to account takeover and data exposure.
How To Fix
Minimum fixed version
1.8.10
This is the first release that contains the fix.
composer require flarum/core:1.8.10Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict cookies to explicit subdomains by setting the cookie domain in your application. For example: 'Set-Cookie: session=token; Domain=community.host.com; Secure; HttpOnly; SameSite=Lax'. This will prevent unauthorized subdomains from accessing the session cookie.
Conclusion
The session hijacking vulnerability in Flarum poses a significant risk to user accounts and sensitive data. It is crucial to update to the latest version of the software and implement recommended security practices to protect against potential exploitation.
See every vulnerability recorded for flarum/core →
FAQ
The vulnerability can lead to account takeover, allowing attackers to gain unauthorized access to user accounts and sensitive data.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to analyze your application without signup.
An attacker must control an authoritative subdomain and the parent domain must not be listed on the Public Suffix List.
The CVSS score of this vulnerability is 6.8, indicating a moderate level of risk.
If an immediate update is not possible, implement the provided workaround to restrict cookie access and mitigate the risk until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for flarum/core.
