{"id":"CVE-2025-71455","kind":"vulnerability","aliases":["CVE-2025-71455"],"related":[],"title":"vtenext: session ID readable from Touch endpoint enables session hijacking","description":"vtenext before 25.02.2 contains a session identifier disclosure vulnerability that allows attackers to read the PHPSESSID value returned by the Touch web service endpoint. Attackers who can run script in the vtenext origin, such as through cross-site scripting, can bypass the HttpOnly flag and hijack authenticated sessions.","summary":"vtenext before 25.02.2 returns the PHPSESSID session cookie value through its Touch web service endpoint, so the HttpOnly protection does not stop it from being read. An attacker who can run script in the vtenext origin, for example through cross-site scripting, can take over logged-in sessions.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["php","runtime","self-hosted","vtenext"],"not_affected_if":["patched-version"],"how_to_check":"- Check the installed vtenext version and confirm whether it is below `25.02.2`.\n- Confirm whether the Touch web service endpoint is reachable from your users' browsers.","fix":"- vtenext: move to `25.02.2` or later.","status":"open","published_at":"2026-11-04T21:17:40+00:00","first_seen_at":"2026-11-04T21:49:16+00:00","triaged_at":"2026-11-04T21:51:20+00:00","updated_at":"2026-11-04T21:51:20+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-04T21:51:20Z","model":"claude-haiku-5-5","output":{"fix":"- vtenext: move to `25.02.2` or later.","reach":"internet","title":"vtenext: session ID readable from Touch endpoint enables session hijacking","impact":"high","summary":"vtenext before 25.02.2 returns the PHPSESSID session cookie value through its Touch web service endpoint, so the HttpOnly protection does not stop it from being read. An attacker who can run script in the vtenext origin, for example through cross-site scripting, can take over logged-in sessions.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["vtenext","php","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"attacker hijacks authenticated user sessions via script injection","analyst_note":"","how_to_check":"- Check the installed vtenext version and confirm whether it is below `25.02.2`.\n- Confirm whether the Touch web service endpoint is reachable from your users' browsers.","plain_action":"","needs_analyst":false,"not_affected_if":["patched-version"],"who_is_affected":"Any vtenext deployment before `25.02.2` is exposed. Exploitation requires script execution in the vtenext origin, such as through an XSS flaw, so instances without any XSS exposure carry lower practical risk. unknown for further detail on which endpoint configurations are affected.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000673,"input_tokens":4159,"output_tokens":514,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2025':12A,15A '-71455':13A,16A '25.02.2':25B,75C 'allow':83C 'attack':50B,84C,97C 'authent':120C 'bypass':114C 'contain':76C 'cooki':30B 'cross':63B,110C 'cross-sit':62B,109C 'cve':11A,14A 'disclosur':80C 'enabl':8A 'endpoint':7A,37B,96C 'exampl':60B 'flag':117C 'hijack':10A,119C 'host':21B 'httpon':40B,116C 'id':3A 'identifi':79C 'log':70B 'logged-in':69B 'origin':58B,105C 'php':17B 'phpsessid':28B,88C 'protect':41B 'read':48B,86C 'readabl':4A 'return':26B,90C 'run':53B,100C 'runtim':18B 'script':54B,65B,101C,112C 'self':20B 'self-host':19B 'servic':36B,95C 'session':2A,9A,29B,72B,78C,121C 'site':64B,111C 'stop':44B 'take':67B 'touch':6A,34B,93C 'valu':31B,89C 'vtenext':1A,22B,23B,57B,73C,104C 'vulner':81C 'web':35B,94C","nicknames":[],"mitigations":[],"who_affected":"Any vtenext deployment before `25.02.2` is exposed. Exploitation requires script execution in the vtenext origin, such as through an XSS flaw, so instances without any XSS exposure carry lower practical risk. unknown for further detail on which endpoint configurations are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","php","runtime","selfhosted","vtenext"],"campaign_type":null,"first_public_at":"2026-11-04T21:17:40+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-71455","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71455","severity":null,"published_at":"2026-11-04T21:17:40+00:00","modified_at":"2026-11-04T21:17:40+00:00","first_seen_at":"2026-11-04T21:49:16+00:00","fetched_at":"2026-11-04T21:49:16+00:00","note":null}],"documents":[{"id":70604,"url":"https://www.vulncheck.com/advisories/vtenext-before-25.02.2-session-identifier-disclosure-via-touch-web-service","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}