CVE-2025-56643: Critical severity Requarks Wiki.js vulnerability
Requarks Wiki.js 2.5.307 does not properly revoke or invalidate active JWT tokens when a user logs out. As a result, previously issued tokens remain valid and can be reused to access the system, even after logout. This behavior affects session integrity and may allow unauthorized access if a token is compromised. The issue is present in the authentication resolver logic and affects both the GraphQL endpoint and the logout mechanism.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-56643?
CVE-2025-56643 is considered a critical vulnerability due to its impact on session integrity and unauthorized access.
How do I fix CVE-2025-56643?
To fix CVE-2025-56643, ensure that your application properly revokes or invalidates JWT tokens upon user logout.
What are the potential impacts of CVE-2025-56643?
CVE-2025-56643 may allow unauthorized users to access the system using previously issued JWT tokens even after a user has logged out.
Which version of Requarks Wiki.js is affected by CVE-2025-56643?
CVE-2025-56643 affects Requarks Wiki.js version 2.5.307.
What is JWT and why is it relevant to CVE-2025-56643?
JWT, or JSON Web Token, is a compact method for securely transmitting information, and in the context of CVE-2025-56643, its improper handling leads to exploitation.