CVE-2025-53826
FileBrowser Has Insecure JWT Handling Which Allows Session Replay Attacks after Logout
Summary
FileBrowser Has Insecure JWT Handling Which Allows Session Replay Attacks after Logout
Original description
The description as published by the source.
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename, and edit files. In version 2.39.0, File Browser’s authentication system issues long-lived JWT tokens that remain valid even after the user logs out. As of time of publication, no known patches exist.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- report github.com