{"action":"Upgrade flarum/framework to 1.8.10 or later.","affected":[{"fixed":"1.8.10","introduced":"0"}],"component":"flarum/framework","cve_ids":["CVE-2025-27794"],"ecosystem":"Packagist","epss":0.00501,"exploited":false,"fixed_versions":["1.8.10"],"ghsa_id":"GHSA-hg9j-64wp-m9px","id":"tcs_01M5KF3MJHDWJJKWBEMB49P5EJ","modified_at":"2025-03-12T22:12:10.626673Z","published_at":"2025-03-12T22:06:16Z","references":["https://osv.dev/vulnerability/GHSA-hg9j-64wp-m9px","https://github.com/flarum/framework/security/advisories/GHSA-hg9j-64wp-m9px","https://nvd.nist.gov/vuln/detail/CVE-2025-27794","https://github.com/flarum/framework/commit/a05aaea3ee1e0a8b870935183193cd6052f1d402","https://github.com/flarum/framework","https://github.com/flarum/framework/releases/tag/v1.8.10"],"severity":{"label":"medium","score":6.8},"sources":[{"source":"osv","source_id":"GHSA-hg9j-64wp-m9px#Packagist/flarum/framework","url":"https://osv.dev/vulnerability/GHSA-hg9j-64wp-m9px"}],"summary":"Flarum Vulnerable to Session Hijacking via Authoritative Subdomain Cookie Overwrite"}