{"cve":"CVE-2025-66803","nvd":{"published":"2026-01-20T19:15:49.537","modified":"2026-06-17T09:57:15.273","status":"Analyzed","description":"Race condition in the turbo-frame element handler in Hotwired Turbo before 8.0.x causes logout operations to fail when delayed frame responses reapply session cookies after logout. This can be exploited by remote attackers via selective network delays (e.g. delaying requests based on sequence or timing) or by physically proximate attackers when the race condition occurs naturally on shared computers.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","score":4.8},"cwes":["CWE-362"],"references":["https://github.com/hotwired/turbo/pull/1399","https://github.com/hotwired/turbo/security/advisories/GHSA-qppm-g56g-fpvp","https://turbo.hotwired.dev/handbook/frames"],"products":["hotwired:turbo"],"source":"nvd","synced_at":"2026-10-19T22:21:16.563232421+00:00"},"epss":{"cve":"CVE-2025-66803","score":0.00283,"percentile":0.20826,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-qppm-g56g-fpvp","url":"https://osv.dev/vulnerability/GHSA-qppm-g56g-fpvp","summary":"Turbo Frame responses can restore stale session cookies","modified":"2026-02-03T03:11:18.973937Z","packages":[{"ecosystem":"npm","name":"@hotwired/turbo","purl":"pkg:npm/%40hotwired/turbo","ranges":["<8.0.21"],"fixed":["8.0.21"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}