{"id":"CVE-2025-66803","url":"https://www.cyber-defence.io/tools/cve/CVE-2025-66803","generatedAt":"2026-10-28T03:55:32.644Z","title":"Race condition in the turbo-frame element handler in Hotwired Turbo before 8.0.x causes logout operations to fail when delayed frame responses reapply session cookies after logout.","description":"Race condition in the turbo-frame element handler in Hotwired Turbo before 8.0.x causes logout operations to fail when delayed frame responses reapply session cookies after logout. This can be exploited by remote attackers via selective network delays (e.g. delaying requests based on sequence or timing) or by physically proximate attackers when the race condition occurs naturally on shared computers.","published":"2026-01-20T19:15:50.000Z","lastModified":"2026-06-17T09:57:15.000Z","status":"Analyzed","sourceIdentifier":"cve@mitre.org","cvss":{"version":"3.1","score":4.8,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"},"cwe":["CWE-362"],"affected":["hotwired/turbo"],"epss":{"score":0.00283,"percentile":0.20657,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.28%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://github.com/hotwired/turbo/pull/1399","tags":["Exploit","Issue Tracking","Patch"],"source":"cve@mitre.org"},{"url":"https://github.com/hotwired/turbo/security/advisories/GHSA-qppm-g56g-fpvp","tags":["Vendor Advisory"],"source":"cve@mitre.org"},{"url":"https://turbo.hotwired.dev/handbook/frames","tags":["Product"],"source":"cve@mitre.org"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2025-66803","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}