Session Management Flaw in nopCommerce Affects Multiple Versions
CVE-2025-11699

7.1HIGH

Key Information:

Vendor

Nopsolutions

Status
Nopcommerce
Vendor
CVE Published:
1 December 2025

What is CVE-2025-11699?

A flaw in nopCommerce versions up to 4.70 and version 4.80.3 allows session hijacking by failing to invalidate session cookies upon logout or session termination. This oversight could enable an attacker, possessing a valid session cookie, to access sensitive endpoints like the admin panel, even after the legitimate user has logged out. Users are advised to upgrade to versions above 4.70, avoiding 4.80.3, to safeguard against this issue.

Affected Version(s)

nopCommerce 4.80.3 <= 4.80.4

nopCommerce 4.10 < 4.70

References

https://seclists.org/fulldisclosure/2025/Aug/14
https://github.com/nopSolutions/nopCommerce/issues/7044
https://www.nopcommerce.com/en/release-notes?srsltid=AfmB...

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.