CVE-2025-27794: Flarum Auth Bypass Vulnerability

CVE-2025-27794 Overview

CVE-2025-27794 is a session hijacking vulnerability in Flarum, an open-source forum software, affecting all versions prior to 1.8.10. The flaw stems from missing session token rotation after authentication [CWE-74]. An attacker who controls an authoritative subdomain under a shared parent domain can set cookies scoped to the parent domain, potentially replacing session tokens for Flarum instances hosted on sibling subdomains. Exploitation requires the parent domain not be listed on the Public Suffix List and depends on user interaction. Browser security mechanisms appear to limit real-world exploitability, though the underlying weakness in session management remained a defect worth patching.

Critical Impact
Attackers controlling a sibling subdomain can theoretically replace authenticated session tokens on a Flarum forum, leading to account takeover. Practical exploitability is constrained by modern browser cookie protections.

Affected Products

Flarum forum software versions prior to 1.8.10
Deployments where the Flarum host shares a registrable parent domain with an attacker-controlled subdomain
Parent domains not present on the Public Suffix List (PSL)

Discovery Timeline

2025-03-12 - CVE-2025-27794 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-27794

Vulnerability Analysis

Flarum stores an access_token inside the server-side session established during authentication. Before the patch, the middleware unconditionally wrote the token retrieved from the flarum_remember cookie into the current session without invalidating or regenerating the session identifier. An attacker controlling evil.host.com could set a cookie scoped to .host.com, and that cookie would be transmitted to community.host.com. When the Flarum instance processed the request, it would adopt the attacker-supplied token as the authenticated session context.

The attack chain requires that the parent domain is not on the Public Suffix List, since PSL-listed domains prevent cookies from being scoped to the shared parent. Modern browsers also enforce cookie prefixes and same-site restrictions that reduce practical exploitability, which is reflected in the high attack complexity rating.

Root Cause

The root cause is the absence of session token rotation on authentication state changes. The RememberFromCookie middleware in framework/core/src/Http/Middleware/RememberFromCookie.php overwrote the session's access_token value without calling invalidate() or regenerateToken(). This violates standard session-fixation defense practices, where session identifiers must be rotated whenever the authenticated principal changes.

Attack Vector

Exploitation is network-based and requires user interaction. The attacker must control a subdomain under the same registrable parent domain as the target Flarum instance. The attacker sets a crafted flarum_remember cookie scoped to the parent domain, then lures a victim to visit the Flarum site. Upon request processing, Flarum accepts the attacker-provided token, binding the victim's browser session to the attacker's account context.

php

// Patch applied in framework/core/src/Http/Middleware/RememberFromCookie.php
/** @var \Illuminate\Contracts\Session\Session $session */
$session = $request->getAttribute('session');
$currentAccessToken = $session->get('access_token');

if ($currentAccessToken !== $token->token) {
    $session->invalidate();
    $session->regenerateToken();

    if ($currentAccessToken) {
        AccessToken::whereToken($currentAccessToken)->delete();
    }

    $session->put('access_token', $token->token);
}

Source: Flarum framework commit a05aaea. The fix now compares the incoming token against the current session token, invalidates the session, regenerates the CSRF token, and revokes the prior access token when a mismatch is detected.

Detection Methods for CVE-2025-27794

Indicators of Compromise

Unexpected flarum_remember cookies originating from sibling subdomains under the same parent domain
Session access_token values changing mid-session without a corresponding login event in application logs
Multiple distinct client IPs or user-agents authenticated to the same Flarum account within a short window

Detection Strategies

Correlate Flarum application logs for access_token rotation events against expected authentication flows
Inspect HTTP request logs for Cookie: flarum_remember= values that do not match tokens issued by the target host
Alert on account activity where the source subdomain of the inbound cookie differs from the canonical Flarum host

Monitoring Recommendations

Enable verbose session lifecycle logging in Flarum and forward events to a centralized SIEM for correlation
Monitor DNS zone records for the appearance of new subdomains under the same parent as the Flarum deployment
Track failed and anomalous authentication patterns per account, including geo-velocity and device-fingerprint deltas

How to Mitigate CVE-2025-27794

Immediate Actions Required

Upgrade Flarum to version 1.8.10 or later, which contains the session invalidation and token regeneration fix
Invalidate all existing sessions and access tokens after upgrading to eliminate any pre-existing hijacked state
Audit the DNS zone for unauthorized or forgotten subdomains that could be leveraged for cookie injection

Patch Information

The fix is included in Flarum 1.8.10, published via GitHub Release v1.8.10 and detailed in GitHub Security Advisory GHSA-hg9j-64wp-m9px. The patch modifies RememberFromCookie middleware to call $session->invalidate() and $session->regenerateToken() when a token mismatch is detected, and deletes the previous AccessToken record from the database.

Workarounds

Host Flarum on a domain listed on the Public Suffix List so cookies cannot be scoped across sibling subdomains
Restrict which subdomains can be provisioned under the parent domain hosting Flarum, and revoke any untrusted delegations
Configure Flarum session cookies with the __Host- prefix and Secure flag to prevent parent-domain cookie overrides

bash

# Upgrade Flarum via Composer to the patched release
composer require flarum/core:^1.8.10
php flarum migrate
php flarum cache:clear