CVE-2025-59841: Flag Forge is a Capture The Flag (CTF) platform. In versions from 2.2.0 to before 2.3.1, the FlagForge web application improperly handles session invalidation…

PriorityP354critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EPSS

0.39%

31.3th percentile

Flag Forge is a Capture The Flag (CTF) platform. In versions from 2.2.0 to before 2.3.1, the FlagForge web application improperly handles session invalidation. Authenticated users can continue to access protected endpoints, such as /api/profile, even after logging out. CSRF tokens are also still valid post-logout, which can allow unauthorized actions. This issue has been patched in version 2.3.1.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
flagforge	flagforge	>= 2.2 < 2.3.1	2.3.1
flagforgectf	flagforge	—	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.