WebSocket Origin Validation Flaws in GroupSession by Cloud and ZION Products
CVE-2025-61987

6.9MEDIUM

Key Information:

Vendor

Japan Total System Co.,ltd.

Status
Groupsession Free Edition
Groupsession Bycloud
Groupsession Zion
Vendor
CVE Published:
12 December 2025

What is CVE-2025-61987?

GroupSession products prior to specified versions fail to properly validate the origin of WebSocket connections. This can lead to exposure of chat information if users interact with maliciously crafted web pages. Users accessing the affected versions are at risk of unauthorized access to sensitive chat data due to inadequate origin checks.

Affected Version(s)

GroupSession byCloud prior to ver5.3.3

GroupSession Free edition prior to ver5.3.0

GroupSession ZION prior to ver5.3.2

References

https://groupsession.jp/info/info-news/security20251208
https://jvn.jp/en/jp/JVN19940619/

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

CVSS V3.0

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-61987 : WebSocket Origin Validation Flaws in GroupSession by Cloud and ZION Products