CVE-2025-48061

MediumCVSS 5.6/10Last modified Jun 17, 2026

Description

wire-webapp is the web application for the open-source messaging service Wire. A change caused a regression resulting in sessions not being properly invalidated. A user that logged out of the Wire webapp, could have been automatically logged in again after re-opening the application. This does not happen when the user is logged in as a temporary user by selecting "This is a public computer" during login or the user selects "Delete all your personal information and conversations on this device" upon logout. The underlying issue has been fixed with wire-webapp version 2025-05-20-production.0. As a workaround, this behavior can be prevented by either deleting all information upon logout as well as logging in as a temporary client.

Metrics

CVSS 3.1 5.6/10CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-613

Affected software

No affected versions have been published.

Timeline

Published: May 22, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-480626.1Discourse is an open-source discussion platform. Prior to version 3.4.4 of the `stable` branch, version 3.5.0.beta5 of the `beta` branch, an CVE-2025-480638.8XWiki is a generic wiki platform. In XWiki 16.10.0, required rights were introduced as a way to limit which rights a document can have. Part CVE-2025-480643.3GitHub Desktop is an open-source, Electron-based GitHub app designed for git development. Prior to version 3.4.20-beta3, an attacker convinc CVE-2025-480656.1Combodo iTop is a web based IT service management tool. Versions prior to 2.7.13 and 3.2.2 are vulnerable to cross-site scripting when a fie CVE-2025-480665.5wire-webapp is the web application for the open-source messaging service Wire. A bug fix caused a regression causing an issue with function CVE-2025-480674.6OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.11.1 contain a vulnerab CVE-2025-480684.3Next.js is a React framework for building full-stack web applications. In versions starting from 13.0 to before 14.2.30 and 15.0.0 to before CVE-2025-480696.6ejson2env allows users to decrypt EJSON secrets and export them as environment variables. Prior to version 2.0.8, the `ejson2env` tool has a CVE-2025-48077.5A vulnerability, which was classified as problematic, was found in SourceCodester Online Student Clearance System 1.0. This affects an unkno CVE-2025-480704.3Plane is open-source project management software. Versions prior to 0.23 have insecure permissions in UserSerializer that allows users to ch CVE-2025-480717.8OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture indus CVE-2025-480729.1OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture indus