CVE-2025-22386

7.3 highEPSS 0.3%

High (7.3) in optimizely configured commerce. EPSS 0.3% chance of exploitation in the next 30 days.

An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity session issue exists in the Commerce B2B application, affecting the longevity of active sessions in the storefront. This allows session tokens tied to logged-out sessions to still be active and usable.

Severity

CVSS 3.1

7.3 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 21% of CVEs (scores of 2026-10-31)
CWE: CWE-613
Published: 2025-01-04
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

optimizely:configured_commerce

References

https://support.optimizely.com/hc/en-us/articles/32695284701069-Configured-Commerce-Security-Advisory-COM-2024-04

Check your stack JSON