CVE-2025-53102 is a critical flaw (CVSS 9.8 in the record) in Discourse. The server does not clear the WebAuthn challenge from the session after a security key login, so it could be reused. Version 3.4.7 on stable and 3.5.0.beta8 on tests-passed fix it, so update your forum.
What's affected
The record and the GitHub advisory GHSA-hv49-93h5-4wcv agree on the facts. Before 3.4.7 on the stable branch and before 3.5.0.beta8 on the tests-passed branch, when a physical security key is used for two factor login, the server generates a WebAuthn challenge that the client signs. The challenge is not cleared from the user's session after authentication, potentially allowing reuse. The record classifies it as CWE-384, session fixation.
The advisory scores the issue as High at 8.2 using CVSS v4, while the NVD record shows 9.8 using CVSS v3.1. The difference comes from scoring versions, and both agree it needs prompt attention.
The advisory says there are no workarounds. Updating is the only fix.
How to check if you're exposed
Open the Discourse admin area and read the version on the dashboard or the update page. A standard Docker install is updated from the host:
cd /var/discourse
git pull
./launcher rebuild app
Compare the result with 3.4.7 for stable or 3.5.0.beta8 for tests-passed. Anything older is affected.
If your forum is hosted by a provider, ask them which version they run and when they applied the fix. Also check whether staff accounts use security keys for two factor login, since those accounts are where the flaw would matter most.
What to do now
- Update Discourse to 3.4.7 or later on stable, or 3.5.0.beta8 or later on tests-passed.
- Take a backup before you rebuild, and test that logins and plugins work afterwards.
- Check the admin logs for logins from unfamiliar locations by staff accounts, especially those with security keys enabled.
- Ask staff to review their active sessions and log out of unknown devices.
- If you use a hosted forum, confirm the update with your provider.
Why it matters
WebAuthn security keys prove possession through a signed challenge. The safety of the scheme depends on each challenge being used once. If the server keeps an old challenge in the session, a captured signed response could be replayed in that session, and the second factor stops adding protection. The advisory says this increases security risk, without giving more detail.
The record gives the 9.8 score, which assumes the worst case on each measure. The advisory's own 8.2 score is lower, and the realistic risk depends on whether an attacker can already capture a login exchange. The CVE is not on the CISA Known Exploited Vulnerabilities list. Forums with moderators and staff keys should update quickly, since those accounts have powers over content and users.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is there a workaround?
The advisory says none. Update to a patched version.
Sources
Last reviewed: 18 October 2026.
