CVE-2025-27223
High · 7.5CVSS
7.5
EPSS
2.2%
Published
Oct 27, 2025
CISA due date
—
The record
TRUfusion Enterprise through 7.10.4.0 exposes the encrypted COOKIEID as an authentication mechanism for some endpoints such as /trufusionPortal/getProjectList. However, the application uses a static key to create the encrypted cookie, ultimately allowing anyone to forge cookies and gain access to sensitive internal information.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|