Live › vulnerability › CVE-2025-13173
Go to dashboardWhen session-bound token binding validation is enabled, tokens tied to a user session are not revoked when that session ends, unless another SSO request is made. An attacker holding such a token can keep accessing applications and resources after the user has logged out, potentially exposing sensitive user data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running the affected SSO product with session-bound tokens and token binding validation turned on, where the "Revoke token upon user logout" option is not active. Systems without token binding validation are described as not exposed by this description. The sources do not name the product or vendor version.
No product ranges from the sources yet.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Tokens associated with user sessions are not revoked when the corresponding user session is terminated, unless another SSO request is initiated. This occurs when the session-bound token feature is enabled with token binding validation and the "Revoke token upon user logout" option is not active. The software fails to automatically invalidate session-bound tokens upon user session termination.
This vulnerability exists when token binding validation is enabled. As a result, a malicious actor possessing a valid session-bound token could exploit this condition to maintain unauthorized access to applications and resources even after the associated user session has ended, potentially leading to the exposure of sensitive user data.
This page as .md · .json · in your agent: get_signal("CVE-2025-13173")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.