CVE-2025-56643: Requarks Wiki.js Auth Bypass Vulnerability

CVE-2025-56643 Overview

CVE-2025-56643 is a session management vulnerability in Requarks Wiki.js version 2.5.307 that fails to properly revoke or invalidate active JWT tokens when a user logs out. This improper session termination allows previously issued tokens to remain valid and reusable for system access even after logout, compromising session integrity and potentially enabling unauthorized access if a token is compromised. The vulnerability affects the authentication resolver logic and impacts both the GraphQL endpoint and the logout mechanism.

Critical Impact

Attackers who obtain a valid JWT token through any means (network interception, XSS, or session theft) can maintain persistent unauthorized access to the Wiki.js system indefinitely, even after the legitimate user has logged out.

Affected Products

• Requarks Wiki.js version 2.5.307

Discovery Timeline

• 2025-11-18 - CVE-2025-56643 published to NVD
• 2025-12-31 - Last updated in NVD database

Technical Details for CVE-2025-56643

Vulnerability Analysis

This vulnerability is classified under CWE-613 (Insufficient Session Expiration), which occurs when a web application does not sufficiently invalidate a session identifier upon user logout. In the case of Wiki.js 2.5.307, the authentication resolver logic fails to implement proper token revocation mechanisms.

JWT (JSON Web Tokens) are stateless by design, meaning the server does not typically maintain session state. However, secure implementations require additional server-side mechanisms such as token blacklisting, short token expiration times, or token version tracking to properly invalidate sessions. The affected version of Wiki.js lacks these compensating controls in its authentication resolver and GraphQL endpoint handling.

The vulnerability allows an attacker who has captured a valid JWT token to continue using that token for authentication purposes indefinitely, regardless of whether the legitimate user has attempted to terminate their session through the logout functionality.

Root Cause

The root cause lies in the authentication resolver logic within Wiki.js 2.5.307. When a user initiates a logout, the application does not add the token to a server-side blacklist or invalidate it through any other mechanism. The JWT remains cryptographically valid until its natural expiration time, which may be significantly longer than the user's intended session duration.

This architectural oversight in session management means that the logout functionality provides only a false sense of security, as tokens continue to grant full authenticated access to the system.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction to exploit once a valid token is obtained. An attacker could leverage this vulnerability through several scenarios:

1. Token Interception: Capturing JWT tokens through network sniffing, man-in-the-middle attacks, or compromised intermediary systems
2. Cross-Site Scripting: Exploiting XSS vulnerabilities to exfiltrate tokens from browser storage
3. Insider Threat: Malicious users or compromised accounts can maintain access even after password changes or account deactivation
4. Session Replay: Tokens obtained from log files, backup systems, or forensic artifacts remain valid

The vulnerability affects both the GraphQL endpoint and standard authentication flows, providing multiple avenues for exploitation. For technical details and proof-of-concept information, refer to the GitHub PoC Repository.

Detection Methods for CVE-2025-56643

Indicators of Compromise

• Multiple authentication sessions from the same JWT token originating from different IP addresses or geographic locations
• API or GraphQL requests using tokens that should have been invalidated after a recorded logout event
• Unusual access patterns where authentication tokens are used after extended periods of inactivity following logout
• Token reuse detected in authentication logs after password reset or account suspension events

Detection Strategies

• Implement logging correlation between logout events and subsequent API requests to identify tokens used post-logout
• Deploy Web Application Firewall (WAF) rules to detect and alert on JWT tokens being reused from suspicious sources
• Monitor GraphQL endpoint access patterns for anomalous authentication behavior
• Create SIEM detection rules that correlate user logout timestamps with continued API access using the same token

Monitoring Recommendations

• Enable comprehensive audit logging for all authentication events including login, logout, and token issuance
• Monitor for lateral movement or privilege escalation attempts using potentially compromised tokens
• Implement real-time alerting for authentication anomalies in the Wiki.js application logs
• Track token usage metrics to identify tokens with abnormally long active sessions

How to Mitigate CVE-2025-56643

Immediate Actions Required

• Review Wiki.js authentication logs for any signs of token reuse after logout events
• Implement network-level controls to limit access to the Wiki.js instance from trusted IP ranges only
• Force re-authentication for all active sessions by regenerating the JWT signing secret
• Consider temporarily disabling the GraphQL endpoint if not required for operations

Patch Information

As of the last NVD update on 2025-12-31, check the official Requarks Wiki.js repository and security advisories for patch availability. Organizations should upgrade to a patched version as soon as one becomes available from the vendor.

Workarounds

• Implement a reverse proxy with session management capabilities to enforce token blacklisting at the network edge
• Reduce JWT token expiration times to minimize the window of exposure for compromised tokens
• Deploy a Redis or database-backed token blacklist implementation at the application layer
• Enable additional authentication factors (MFA) to reduce the impact of token compromise
• Restrict Wiki.js access to VPN-only networks to limit attacker opportunities for token interception

Administrators can implement session controls through reverse proxy configurations. For specific implementation guidance, consult your proxy documentation to configure session validation that references a server-side token store, rejecting any tokens that have been explicitly revoked following logout events.