CVE-2025-60425

Published: Oct 27, 2025Modified: Jun 17, 2026

8.6

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

Exploitability: 3.9 / Impact: 4.7

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Nagios Fusion v2024R1.2 and v2024R2 does not invalidate already existing session tokens when the two-factor authentication mechanism is enabled, allowing attackers to perform a session hijacking attack.

Affected (2)

Products: Nagios: Fusion

Nagios

1 product

Fusion

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Nagios Fusion	Version 2024 r1.2
Nagios Fusion	Version 2024 r2.1

Related CWEs

CWE-491

Public cloneable() Method Without Final ('Object Hijack')

A class has a cloneable() method that is not declared final, which allows an object to be created without calling the constructor. This can cause the object to be in an unexpected state.

References (3)

https://github.com/aakashtyal/Session-Persistence-After-Enabling-2FA

Source: cve@mitre.org

MitigationThird Party Advisory

https://github.com/aakashtyal/Session-Persistence-After-Enabling-2FA-CVE-2025-60425

Source: cve@mitre.org

MitigationThird Party Advisory

https://www.nagios.com/changelog/#fusion

Source: cve@mitre.org

Release Notes

Timeline

No history available yet.