CVE-2025-60425

High · 8.6

CVSS

8.6

EPSS

1.0%

Published

Oct 27, 2025

CISA due date

—

The record

Nagios Fusion v2024R1.2 and v2024R2 does not invalidate already existing session tokens when the two-factor authentication mechanism is enabled, allowing attackers to perform a session hijacking attack.

Affected packages

Ecosystem	Package	Introduced	Fixed