CVE-2024-25977 — The application does not change the session token when using the login or logout functionality. An attacker can set a session token in the victim's browser (e.g. via XSS) and prompt the victim to — CVE Database · The Intelligence Room