Insufficient Session Expiration in FileBrowser - CVE-2025-53826

Vulnerability details

The vulnerability allows a remote user to bypass logout and retain access to authenticated functionality.

The vulnerability exists due to insufficient session expiration in JWT token handling in the authentication system when processing requests with previously issued JWT tokens after logout. A remote user can replay a previously issued token to bypass logout and retain access to authenticated functionality.

The issue occurs because logout does not invalidate already issued JWTs, and the tokens remain usable until they expire naturally.

Affected software

How to mitigate CVE-2025-53826

External References

• https://github.com/filebrowser/filebrowser/security/advisories/GHSA-7xwp-2cpp-p8r7
• https://github.com/filebrowser/filebrowser/blob/master/http/auth.go

Related Security Bulletins

• Insufficient Session Expiration in FileBrowser