CVE-2025-11699: High severity Nopcommerce NopCommerce vulnerability
nopCommerce v4.70 and prior, and version 4.80.3, does not invalidate session cookies after logout or session termination, allowing an attacker who has a a valid session cookie access to privileged endpoints (such as /admin) even after the legitimate user has logged out, enabling session hijacking. Any version above 4.70 that is not 4.80.3 fixes the vulnerability.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-11699?
CVE-2025-11699 has a medium severity rating due to its potential to allow unauthorized access to privileged areas after logout.
How do I fix CVE-2025-11699?
To mitigate CVE-2025-11699, update nopCommerce to version 4.80.4 or later, which includes the fix for session cookie invalidation.
What are the risks associated with CVE-2025-11699?
CVE-2025-11699 poses the risk of unauthorized access to admin functions by allowing attackers to use valid session cookies after a user has logged out.
Which versions of nopCommerce are affected by CVE-2025-11699?
CVE-2025-11699 affects nopCommerce versions 4.70 and earlier, as well as version 4.80.3.
Is there a workaround for CVE-2025-11699 if I cannot upgrade?
If upgrading is not immediately possible, consider implementing additional session security measures, such as monitoring for unusual session activity.