ghsa-7xwp-2cpp-p8r7
Vulnerability from github
Summary
File Browser’s authentication system issues long-lived JWT tokens that remain valid even after the user logs out. Please refer to the CWE's listed in this report for further reference and system standards. In summary, the main issue is:
- Tokens remain valid after logout (session replay attacks)
In this report, I used docker as the documentation instruct:
docker run \
-v filebrowser_data:/srv \
-v filebrowser_database:/database \
-v filebrowser_config:/config \
-p 8080:80 \
filebrowser/filebrowser
Details
Issue: Tokens remain valid after logout (session replay attacks)
After logging in and receiving a JWT token, the user can explicitly "log out." However, this action does not invalidate the issued JWT. Any captured token can be replayed post-logout until it expires naturally. The backend does not track active sessions or invalidate existing tokens on logout. Login request:
``` POST /api/login HTTP/1.1 Host: machine.local:8090 Content-Length: 69
{"username":"admin","password":"password-here","recaptcha":""} ```
The check found in the code https://github.com/filebrowser/filebrowser/blob/master/http/auth.go is not enough. There is no server-side blacklist or token invalidation on logout. Token renewal and validity only depends on expiry and user store timestamps:
expired := !tk.VerifyExpiresAt(time.Now().Add(time.Hour), true)
updated := tk.IssuedAt != nil && tk.IssuedAt.Unix() < d.store.Users.LastUpdate(tk.User.ID)
PoC
Issue: Tokens remain valid after logout (session replay attacks)
- Login and capture the generate JWT. Eg. the http request:
``` POST /api/login HTTP/1.1 Host: machine.local:8090 Content-Length: 69
{"username":"admin","password":"password-here","recaptcha":""} ```
- Logout in the dashboard. And then try to use the old generated JWT to access any authenticated endpoint eg:
``` GET /api/resources HTTP/1.1 Host: machine.local:8090 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36 X-Auth: Old-JWT-token-here Content-Length: 173 Accept: / Referer: http://machine.local:8090/files/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Content-Length: 26
Connection: keep-alive ```
Impact
- A valid JWT remains active after user logout.
- If stolen, tokens persist access indefinitely until expiry.
- Violates OWASP Top 10 A2:2021 - Broken Authentication.
Recommendations
- Read all CWE's attached in this report
- Invalidate JWTs on logout via session store / token blacklist.
- Reduce JWT ExpiresAt where possible or use short-lived + refresh tokens.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/filebrowser/filebrowser"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.39.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/filebrowser/filebrowser/v2"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.39.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-53826"
],
"database_specific": {
"cwe_ids": [
"CWE-305",
"CWE-384",
"CWE-613"
],
"github_reviewed": true,
"github_reviewed_at": "2025-07-16T14:09:28Z",
"nvd_published_at": "2025-07-15T18:15:24Z",
"severity": "HIGH"
},
"details": "### Summary\n\nFile Browser\u2019s authentication system issues long-lived JWT tokens that remain valid even after the user logs out. Please refer to the CWE\u0027s listed in this report for further reference and system standards. In summary, the main issue is:\n\n- Tokens remain valid after logout (session replay attacks)\n\nIn this report, I used docker as the documentation instruct:\n\n```\ndocker run \\\n -v filebrowser_data:/srv \\\n -v filebrowser_database:/database \\\n -v filebrowser_config:/config \\\n -p 8080:80 \\\n filebrowser/filebrowser\n```\n\n### Details\n\n**Issue: Tokens remain valid after logout (session replay attacks)**\n\nAfter logging in and receiving a JWT token, the user can explicitly \"log out.\" However, this action does not invalidate the issued JWT. Any captured token can be replayed post-logout until it expires naturally. The backend does not track active sessions or invalidate existing tokens on logout. Login request:\n\n```\nPOST /api/login HTTP/1.1\nHost: machine.local:8090\nContent-Length: 69\n\n{\"username\":\"admin\",\"password\":\"password-here\",\"recaptcha\":\"\"}\n```\n\nThe check found in the code `https://github.com/filebrowser/filebrowser/blob/master/http/auth.go` is not enough. There is no server-side blacklist or token invalidation on logout. Token renewal and validity only depends on expiry and user store timestamps:\n\n```\nexpired := !tk.VerifyExpiresAt(time.Now().Add(time.Hour), true)\nupdated := tk.IssuedAt != nil \u0026\u0026 tk.IssuedAt.Unix() \u003c d.store.Users.LastUpdate(tk.User.ID)\n```\n\n### PoC\n\n**Issue: Tokens remain valid after logout (session replay attacks)**\n\n- Login and capture the generate JWT. Eg. the http request:\n\n```\nPOST /api/login HTTP/1.1\nHost: machine.local:8090\nContent-Length: 69\n\n{\"username\":\"admin\",\"password\":\"password-here\",\"recaptcha\":\"\"}\n```\n\n- Logout in the dashboard. And then try to use the old generated JWT to access any authenticated endpoint eg:\n\n```\nGET /api/resources HTTP/1.1\nHost: machine.local:8090\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36\nX-Auth: Old-JWT-token-here\nContent-Length: 173\nAccept: */*\nReferer: http://machine.local:8090/files/\nAccept-Encoding: gzip, deflate, br\nAccept-Language: en-US,en;q=0.9\nContent-Length: 26\n\nConnection: keep-alive\n```\n\n### Impact\n\n- A valid JWT remains active after user logout.\n- If stolen, tokens persist access indefinitely until expiry.\n- Violates OWASP Top 10 A2:2021 - Broken Authentication.\n\n### Recommendations\n\n- Read all CWE\u0027s attached in this report\n- Invalidate JWTs on logout via session store / token blacklist.\n- Reduce JWT ExpiresAt where possible or use short-lived + refresh tokens.",
"id": "GHSA-7xwp-2cpp-p8r7",
"modified": "2025-07-29T23:17:56Z",
"published": "2025-07-16T14:09:28Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/filebrowser/filebrowser/security/advisories/GHSA-7xwp-2cpp-p8r7"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53826"
},
{
"type": "WEB",
"url": "https://github.com/filebrowser/filebrowser/issues/5216"
},
{
"type": "PACKAGE",
"url": "https://github.com/filebrowser/filebrowser"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P",
"type": "CVSS_V4"
}
],
"summary": "File Browser\u2019s insecure JWT handling can lead to session replay attacks after logout"
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.