{"id":"CVE-2025-48061","aliases":["EUVD-2025-16186","GHSA-7r6m-qjwm-w44q"],"status":"published","title":"wire-webapp Has Insufficient Session Invalidation after User Logout","description":"wire-webapp is the web application for the open-source messaging service Wire. A change caused a regression resulting in sessions not being properly invalidated. A user that logged out of the Wire webapp, could have been automatically logged in again after re-opening the application. This does not happen when the user is logged in as a temporary user by selecting \"This is a public computer\" during login or the user selects \"Delete all your personal information and conversations on this device\" upon logout. The underlying issue has been fixed with wire-webapp version 2025-05-20-production.0. As a workaround, this behavior can be prevented by either deleting all information upon logout as well as logging in as a temporary client.","severity":{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00149,"percentile":0.04184,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-613"],"published":"2025-05-22T17:04:42Z","modified":"2026-10-28T02:30:23Z","products":[{"vendor":"wireapp","product":"wire-webapp"}],"references":[{"url":"https://github.com/wireapp/wire-webapp/security/advisories/GHSA-7r6m-qjwm-w44q","tags":["x_refsource_CONFIRM","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48061.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-48061","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-48061","title":"wire-webapp Has Insufficient Session Invalidation after User Logout","description":"wire-webapp is the web application for the open-source messaging service Wire. A change caused a regression resulting in sessions not being properly invalidated. A user that logged out of the Wire webapp, could have been automatically logged in again after re-opening the application. This does not happen when the user is logged in as a temporary user by selecting \"This is a public computer\" during login or the user selects \"Delete all your personal information and conversations on this device\" upon logout. The underlying issue has been fixed with wire-webapp version 2025-05-20-production.0. As a workaround, this behavior can be prevented by either deleting all information upon logout as well as logging in as a temporary client.","status":"published","published":"2025-05-22T17:04:42.918Z","modified":"2025-05-22T17:32:16.333Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-613"],"updated_at":"2026-11-02T14:32:41.41198Z"}],"euvd":[{"id":"EUVD-2025-16186","description":"wire-webapp is the web application for the open-source messaging service Wire. A change caused a regression resulting in sessions not being properly invalidated. A user that logged out of the Wire webapp, could have been automatically logged in again after re-opening the application. This does not happen when the user is logged in as a temporary user by selecting \"This is a public computer\" during login or the user selects \"Delete all your personal information and conversations on this device\" upon logout. The underlying issue has been fixed with wire-webapp version 2025-05-20-production.0. As a workaround, this behavior can be prevented by either deleting all information upon logout as well as logging in as a temporary client.","status":"published","published":"2025-05-22T17:04:42Z","modified":"2025-05-22T17:32:16Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T20:32:40.249574Z"}],"nvd":[{"id":"CVE-2025-48061","description":"wire-webapp is the web application for the open-source messaging service Wire. A change caused a regression resulting in sessions not being properly invalidated. A user that logged out of the Wire webapp, could have been automatically logged in again after re-opening the application. This does not happen when the user is logged in as a temporary user by selecting \"This is a public computer\" during login or the user selects \"Delete all your personal information and conversations on this device\" upon logout. The underlying issue has been fixed with wire-webapp version 2025-05-20-production.0. As a workaround, this behavior can be prevented by either deleting all information upon logout as well as logging in as a temporary client.","status":"published","published":"2025-05-22T17:15:25.033Z","modified":"2026-06-17T09:29:05.193Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-613"],"updated_at":"2026-11-02T14:11:09.562272Z"}],"osv":[{"id":"CVE-2025-48061","title":"wire-webapp Has Insufficient Session Invalidation after User Logout","description":"wire-webapp is the web application for the open-source messaging service Wire. A change caused a regression resulting in sessions not being properly invalidated. A user that logged out of the Wire webapp, could have been automatically logged in again after re-opening the application. This does not happen when the user is logged in as a temporary user by selecting \"This is a public computer\" during login or the user selects \"Delete all your personal information and conversations on this device\" upon logout. The underlying issue has been fixed with wire-webapp version 2025-05-20-production.0. As a workaround, this behavior can be prevented by either deleting all information upon logout as well as logging in as a temporary client.","status":"published","published":"2025-05-22T17:04:42.918Z","modified":"2026-10-28T02:30:23.152514893Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"cwes":["CWE-613"],"updated_at":"2026-11-02T15:44:50.037003Z"}]}}