CVE-2025-53102: Discourse's WebAuthn challenge isn't cleared from user session after authentication
Discourse is an open-source community discussion platform. Prior to version 3.4.7 on the stable branch and version 3.5.0.beta.8 on the tests-passed branch, upon issuing a physical security key for 2FA, the server generates a WebAuthn challenge, which the client signs. The challenge is not cleared from the user’s session after authentication, potentially allowing reuse and increasing security risk. This is fixed in versions 3.4.7 and 3.5.0.beta.8.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-53102?
CVE-2025-53102 is considered a moderate severity vulnerability affecting certain versions of Discourse.
How do I fix CVE-2025-53102?
To fix CVE-2025-53102, upgrade Discourse to version 3.4.7 or 3.5.0.beta.8 and later.
What are the impacts of CVE-2025-53102 on users?
CVE-2025-53102 may compromise the security of two-factor authentication for users relying on physical security keys.
Which versions of Discourse are affected by CVE-2025-53102?
CVE-2025-53102 affects Discourse versions prior to 3.4.7 and 3.5.0.beta.8.
Is CVE-2025-53102 part of a broader series of vulnerabilities?
CVE-2025-53102 specifically addresses an issue with WebAuthn challenges in Discourse but is not part of a broader series.