OrangeHRM is Vulnerable to Persistent Session Access Due to Missing Invalidation After User Disable and Password Change_CVE-2025-66289

{
    "lastseen": "",
    "description": "OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the application does not invalidate existing sessions when a user is disabled or when a password change occurs, allowing active session cookies to remain valid indefinitely. As a result, a disabled user, or an attacker using a compromised account, can continue to access protected pages and perform operations as long as a prior session remains active. Because the server performs no session revocation or session-store cleanup during these critical state changes, disabling an account or updating credentials has no effect on already-established sessions. This makes administrative disable actions ineffective and allows unauthorized users to retain full access even after an account is closed or a password is reset, exposing the system to prolonged unauthorized use and significantly increasing the impact of account takeover scenarios. This issue has been patched in version 5.8.",
    "published": "2025-11-29T03:06:25.730Z",
    "modified": "2025-11-29T03:06:25.730Z",
    "type": "cve",
    "title": "OrangeHRM is Vulnerable to Persistent Session Access Due to Missing Invalidation After User Disable and Password Change",
    "source": "GitHub_M",
    "references": "https://github.com/orangehrm/orangehrm/security/advisories/GHSA-99qp-xh4q-pr9x",
    "id": "CVE-2025-66289",
    "bulletinFamily": "",
    "cwe": [
        "CWE-613"
    ],
    "cvelist": null,
    "sourceData": "orangehrm orangehrm >= 5.0, < 5.8",
    "sourceHref": "",
    "cvss": {
        "score": 8.7,
        "severity": "HIGH",
        "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
        "version": "4.0"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "orangehrm",
    "version": ">= 5.0, < 5.8",
    "vendor": "orangehrm",
    "ai_description": "The OrangeHRM application is vulnerable to persistent session access due to missing session invalidation after user disable and password change, allowing unauthorized users to retain full access even after an account is closed or a password is reset.",
    "ai_severity": "High",
    "ai_vendor": "OrangeHRM",
    "ai_product": "OrangeHRM",
    "ai_version": "5.0-5.7",
    "ai_score": 8.7
}