CVE-2025-35433
CISA Thorium does not properly invalidate previously used tokens
Summary
CISA Thorium does not properly invalidate previously used tokens
Original description
The description as published by the source.
CISA Thorium does not properly invalidate previously used tokens when resetting passwords. An attacker that possesses a previously used token could still log in after a password reset. Fixed in 1.1.1.
References
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web github.com
- web raw.githubusercontent.com
- web cve.org