Loading vulnerability…
Session cookie invalidation flaw in nopCommerce
CVE-2025-11699 is a session management vulnerability in nopCommerce affecting version 4.70 and prior, and version 4.80.3. The application does not properly invalidate session cookies after user logout or session termination. As a result, a previously issued valid session cookie can remain usable and continue to authorize access to privileged application endpoints, including administrative paths such as /admin, even after the legitimate user has logged out. This creates a post-logout session hijacking condition in which possession of a valid session token is sufficient to continue an authenticated session.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker who obtains a valid nopCommerce session cookie can continue to access the victim's authenticated session after logout, including privileged or administrative functionality. In the case of an administrator session, this can result in admin account takeover and unauthorized access to sensitive management features. Reported downstream risks include unauthorized administrative actions, data access, financial fraud, ransomware deployment, or cryptocurrency theft, depending on the role and environment.
If you can’t patch tonight, do this now.
If immediate patching is not possible, restrict access to privileged endpoints such as /admin, closely monitor for suspicious or reused session activity, and implement compensating session controls where feasible. The advisory specifically suggests additional session management protections such as IP binding and forced server-side session invalidation on logout.
Patch, then assume compromise.
Upgrade nopCommerce to a fixed release. The provided advisory states that any version above 4.70 except 4.80.3 contains the fix, and specifically recommends upgrading to 4.90.3 or later. Systems running version 4.80.3 or versions prior to or including 4.70 should be updated to the latest available fixed version immediately.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.