Medium
wire-webapp Has Insufficient Session Invalidation after User Logout
Type: advisorySources: OSV
wire-webapp is the web application for the open-source messaging service Wire. A change caused a regression resulting in sessions not being properly invalidated. A user that logged out of the Wire webapp, could have been automatically logged in again after re-opening the application. This does not happen when the user is logged in as a temporary user by selecting "This is a public computer" during login or the user selects "Delete all your personal information and conversations on this device" upon logout. The underlying issue has been fixed with wire-webapp version 2025-05-20-production.0. As a workaround, this behavior can be prevented by either deleting all information upon logout as well as logging in as a temporary client.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2025-48061
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 2 Nov 2026, 20:03 UTC · Revision 1
Source evidence
wire-webapp Has Insufficient Session Invalidation after User Logout
core-osv · Original sourcePublished 22 May 2025, 17:04 UTC
wire-webapp is the web application for the open-source messaging service Wire. A change caused a regression resulting in sessions not being properly invalidated. A user that logged out of the Wire webapp, could have been automatically logged in again after re-opening the application. This does not happen when the user is logged in as a temporary user by selecting "This is a public computer" during login or the user selects "Delete all your personal information and conversations on this device" upon logout. The underlying issue has been fixed with wire-webapp version 2025-05-20-production.0. As a workaround, this behavior can be prevented by either deleting all information upon logout as well as logging in as a temporary client.
osv:CVE-2025-48061
Complete source record
{
"id": "519b1481bac29220b6beeb2cc7d989cd720ca1baae5a8ee725c4cf2e8cf9f259",
"url": "https://osv.dev/vulnerability/CVE-2025-48061",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "wire-webapp Has Insufficient Session Invalidation after User Logout",
"summary": "wire-webapp is the web application for the open-source messaging service Wire. A change caused a regression resulting in sessions not being properly invalidated. A user that logged out of the Wire webapp, could have been automatically logged in again after re-opening the application. This does not happen when the user is logged in as a temporary user by selecting \"This is a public computer\" during login or the user selects \"Delete all your personal information and conversations on this device\" upon logout. The underlying issue has been fixed with wire-webapp version 2025-05-20-production.0. As a workaround, this behavior can be prevented by either deleting all information upon logout as well as logging in as a temporary client.",
"evidence": "osv:CVE-2025-48061",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2025-48061",
"aliases": [
"CVE-2025-48061",
"GHSA-7r6m-qjwm-w44q"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/wireapp/wire-webapp",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "42190522a528728d34fb179bc4d112182354feac"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "2025-05-20-production.0"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
}
]
}
}
],
"versions": [
"2025-05-14-production.0",
"2025-04-29-production.0",
"2025-04-14-production.0",
"2025-03-13-production.0",
"2025-01-23-production.0",
"2025-01-21-staging.0",
"2025-01-16-production.1",
"2025-01-16-production.0",
"2025-01-15-staging.0",
"2025-01-13-staging.0",
"2025-01-06-staging.0",
"2024-11-13-production.0",
"2024-09-02-staging.0",
"2024-09-02-production.0",
"2024-08-22-production.0",
"2024-08-07-production.0",
"2024-04-25-production.0",
"2024-04-18-production.0",
"2024-04-11-production.0",
"2024-03-25-staging.0",
"2024-03-21-staging.0",
"2024-02-15-staging.1",
"2024-02-15-staging.0",
"2024-01-15-staging.0",
"2023-11-09-staging.0",
"2023-09-28-staging.0",
"2023-09-20-staging.0",
"2023-09-06-staging.0",
"2023-09-04-staging.0",
"2023-07-31-staging.0",
"2023-07-17-staging.0",
"2023-05-23-staging.0",
"2023-05-04-staging.0",
"2023-04-25-staging.0",
"2023-04-20-staging.0",
"2023-04-19-staging.0",
"2023-04-18-staging.0",
"2023-04-13-staging.0",
"2023-03-30-staging.0",
"2023-03-22-staging.0",
"2023-03-14-staging.0",
"2023-02-28-staging.0",
"2023-02-23-staging.0",
"2023-02-22-staging.0",
"2023-02-20-staging.2",
"2023-02-20-staging.1",
"2023-02-20-staging.0",
"2023-02-13-staging.0",
"2023-02-07-staging.0",
"2023-01-31-staging.0",
"2023-01-17-staging.0",
"2023-01-09-staging.0",
"2023-01-09-staging.1",
"2022-12-19-staging.0",
"2022-12-13-staging.1",
"2022-12-13-staging.0",
"2022-12-08-staging.0",
"2022-12-07-staging.0",
"2022-11-30-staging.0",
"2022-11-28-staging.0",
"2022-11-18-staging.0",
"2022-11-17-staging.5",
"2022-11-17-staging.4",
"2022-11-17-staging.3",
"2022-11-17-staging.2",
"2022-11-17-staging.1",
"2022-11-17-staging.0",
"2022-10-26-staging.0",
"2022-10-14-staging.0",
"2022-10-04-staging.0",
"2022-09-28-staging.0",
"2022-09-27-staging.0",
"2022-09-26-staging.0",
"2022-09-13-staging.0",
"2022-09-05-staging.0",
"2022-09-02-staging.0",
"2022-08-30-staging.0",
"2022-08-26-staging.0",
"2022-08-22-staging.1",
"2022-08-24-staging.0",
"2022-08-22-staging.0",
"2022-07-04-staging.0",
"2022-06-30-staging.0",
"2022-06-28-staging.0",
"2022-06-23-staging.0",
"2022-06-21-staging.0",
"2022-06-17-staging.0",
"2022-06-13-staging.0",
"2022-06-08-staging.0",
"2022-06-07-staging.0",
"2022-06-01-staging.0",
"2022-05-24-staging.0",
"2022-04-19-staging.0",
"2022-04-13-staging.0",
"2022-03-31-staging.0",
"2022-03-29-staging.0",
"2022-03-28-staging.0",
"2022-03-23-staging.0",
"2022-02-17-staging.0",
"2022-02-07-production.0",
"2022-01-27-production.0",
"2021-12-02-production.0",
"2021-12-01-production.0",
"2021-11-01-production.0",
"2021-10-04-production.0",
"2021-09-27-production.0",
"2021-09-13-production.0",
"2021-08-30-production.0",
"2021-07-09-staging.0",
"2021-06-17-staging.0",
"2021-05-27-staging.0",
"2021-05-06-staging.0",
"2021-04-28-staging.0",
"2021-04-26-staging.0",
"2021-04-15-staging.0",
"2021-04-06-staging.0",
"2021-03-25-staging.0",
"2021-03-24-staging.0",
"2021-03-18-staging.0",
"2021-03-10-staging.0",
"2021-03-05-staging.0",
"2021-02-26-staging.0",
"2021-02-22-staging.1",
"2021-02-15-staging.0",
"2021-02-04-staging.0",
"2021-02-03-staging.0",
"2021-01-27-staging.0",
"2021-01-18-staging.1",
"2020-12-10-staging.0",
"2020-11-30-staging.0",
"v0.2.0",
"2020-10-27-staging.0",
"2020-10-26-staging.0",
"2020-10-21-staging.0",
"2020-10-21-staging.1",
"2020-10-15-staging.0",
"2020-10-14-staging.0",
"2020-10-07-staging.0",
"2020-10-06-staging.0",
"2020-10-01-staging.0",
"2020-09-18-staging.0",
"2020-09-17-staging.0",
"2020-09-08-staging.0",
"2020-09-04-staging.0",
"2020-09-03-staging.0",
"2020-09-02-staging.0",
"2020-08-25-staging.0",
"2020-08-21-staging.0",
"2020-08-19-staging.0",
"2020-08-18-staging.0",
"2020-08-14-staging.0",
"2020-08-12-staging.1",
"2020-08-12-staging.0",
"2020-08-06-staging.0",
"2020-07-07-staging.1",
"2020-07-07-staging.0",
"2020-06-19-staging.0",
"2020-06-15-staging.0",
"2020-06-12-staging.0",
"2020-06-10-staging.0",
"2020-06-08-staging.0",
"2020-06-05-staging.0",
"2020-05-29-staging.0",
"2020-05-28-staging.0",
"2020-05-27-staging.0",
"2020-05-26-staging.0",
"2020-05-22-staging.0",
"2020-05-19-staging.0",
"2020-05-18-staging.0",
"2020-05-15-staging.0",
"2020-05-14-staging.0",
"2020-05-13-staging.0",
"2020-05-07-staging.0",
"2020-05-06-staging.0",
"2020-05-04-staging.0",
"2020-04-28-staging.0",
"2020-04-23-staging.0",
"2020-04-22-staging.0",
"2020-04-16-staging.0",
"2020-04-09-staging.0",
"2020-04-01-staging.0",
"2020-03-30-staging.0",
"2020-03-20-staging.0",
"2020-03-18-staging.0",
"2020-03-12-staging.0",
"2020-03-06-staging.0",
"2020-03-03-staging.0",
"2020-02-28-staging.0",
"2020-02-26-staging.0",
"2020-02-24-staging.0",
"2020-02-20-staging.0",
"2020-02-18-staging.0",
"2020-02-11-staging.1",
"2020-02-11-staging.0",
"2020-02-06-staging.0",
"2020-01-21-staging.0",
"2020-01-17-staging.0",
"2020-01-16-staging.0",
"2020-01-15-staging.0",
"2020-01-09-staging.0",
"2019-12-20-staging.0",
"2019-12-12-staging.0",
"2019-11-25-staging.0",
"2019-11-21-staging.0",
"2019-11-19-staging.0",
"2019-11-12-staging.0",
"2019-11-08-staging.0",
"2019-10-31-staging.0",
"2019-10-29-staging.0",
"2019-10-25-staging.0",
"2019-10-21-staging.0",
"2019-10-16-staging.1",
"2019-10-16-production.1",
"2019-10-16-staging.0",
"2019-10-14-staging.0",
"2019-10-10-staging.1",
"2019-10-10-staging.0",
"2019-10-08-staging.0",
"2019-10-07-staging.1",
"2019-10-07-staging.0",
"2019-09-23-staging.0",
"2019-09-18-staging.0",
"2019-09-13-staging.0",
"2019-09-12-staging.0",
"2019-09-09-staging.0",
"2019-09-05-staging.0",
"2019-08-27-staging.0",
"2019-08-22-staging.0",
"2019-08-19-staging.0",
"2019-08-14-staging.0",
"2019-08-01-staging.0",
"2019-07-30-staging.0",
"2019-07-01-staging.0",
"2019-06-26-staging.0",
"2019-06-25-staging.0",
"2019-06-24-staging.0",
"2019-06-20-staging.0",
"2019-06-04-staging.0",
"2019-05-31-staging.0",
"2019-05-15-staging.0",
"2019-05-14-staging.0",
"2019-04-29-staging.0",
"2019-04-25-staging.0",
"2019-04-18-staging.0",
"2019-04-23-staging.1",
"2019-04-11-staging.0",
"2019-04-08-staging.0",
"2019-03-28-staging.0",
"2019-03-25-staging.1",
"2019-03-25-staging.0",
"2019-03-20-staging.0",
"2019-03-13-staging.0",
"2019-03-11-staging.0",
"2019-03-07-staging.0",
"2019-03-05-staging.0",
"2019-02-28-15-10",
"2019-02-28-staging.0",
"2019-02-27-staging.0",
"2019-02-18-staging.0",
"2019-02-13-staging.0",
"2019-02-11-staging.2",
"2019-02-11-staging.1",
"2019-02-11-staging.0",
"2017-04-20-15-54",
"2016-11-08-15-06",
"2016-08-24-10-10",
"2016-08-23-09-31"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-48061.json"
}
}
],
"modified": "2026-10-28T02:30:23.152514893Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48061.json",
"https://github.com/wireapp/wire-webapp/security/advisories/GHSA-7r6m-qjwm-w44q",
"https://nvd.nist.gov/vuln/detail/CVE-2025-48061"
],
"provider_metadata": {
"cwe_ids": [
"CWE-613"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48061.json"
}
},
"related_cves": [
{
"value": "CVE-2025-48061",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 489559,
"published_at": "2025-05-22T17:04:42.918+00:00"
}