CVE-2025-22386
CVSS 3.1 Score 7.3 of 10 (high)
Details
Published Jan 4, 2025
Updated: Jan 6, 2025
CWE ID 613
Summary
CVE-2025-22386 is a medium-severity session issue affecting Optimizely's Configured Commerce before version 5.2.2408. The Commerce B2B application is the target, with a vulnerability that extends the lifespan of active sessions in the storefront beyond logout. As a result, session tokens tied to logged-out sessions remain usable, posing a potential security risk. Attackers could exploit this flaw to gain unauthorized access or perform unintended actions on behalf of other users.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- Configured Commerce
Affected Vendors
- Optimizely