---
id: "CVE-2025-71455"
kind: "vulnerability"
aliases: ["CVE-2025-71455"]
title: "vtenext: session ID readable from Touch endpoint enables session hijacking"
severity: "medium"
cvss: 5.9
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["php", "runtime", "self-hosted", "vtenext"]
not_affected_if: ["patched-version"]
published_at: "2026-11-04T21:17:40+00:00"
first_seen_at: "2026-11-04T21:49:16+00:00"
updated_at: "2026-11-04T21:51:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-71455", "first_seen_at": "2026-11-04T21:49:16+00:00"}]
exploit_sources: []
---

# vtenext: session ID readable from Touch endpoint enables session hijacking

vtenext before 25.02.2 returns the PHPSESSID session cookie value through its Touch web service endpoint, so the HttpOnly protection does not stop it from being read. An attacker who can run script in the vtenext origin, for example through cross-site scripting, can take over logged-in sessions.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed vtenext version and confirm whether it is below `25.02.2`.
- Confirm whether the Touch web service endpoint is reachable from your users' browsers.

## Fix

- vtenext: move to `25.02.2` or later.

## Timeline

- 2026-11-04T21:49:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-71455

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/vtenext-before-25.02.2-session-identifier-disclosure-via-touch-web-service

## From the sources

vtenext before 25.02.2 contains a session identifier disclosure vulnerability that allows attackers to read the PHPSESSID value returned by the Touch web service endpoint. Attackers who can run script in the vtenext origin, such as through cross-site scripting, can bypass the HttpOnly flag and hijack authenticated sessions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_