CVE-2025-62717 is rated critical (CVSS 9.1) in NVD. It is an authentication flaw (CWE-287) in Emlog Pro 2.5.23, where the email verification code is not cleared after use, so it can be reused. The fix is commit 1f726df. The project itself rates it Low.
What's affected
The record names Emlog 2.5.23 (Emlog Pro) and says the issue is fixed in commit 1f726df. The project did not give a fixed release number in the sources I fetched, so check the Emlog releases page for the first release that contains that commit.
Source conflict to note. NVD scores this 9.1 Critical. The project advisory (GHSA-wwj4-ppfj-hcm6) lists its own severity as Low. The advisory says the function checkMailCode() in admin/user.php clears the wrong session key. It calls unset($_SESSION['code']) where it should clear mail_code. As a result, the verification code can be reused anywhere an email verification code is required.
How to check if you're exposed
Find the version in the Emlog admin interface and compare it with the release that includes commit 1f726df. If you run from Git, check whether your tree contains the commit:
git log --oneline | grep 1f726df
git merge-base --is-ancestor 1f726df HEAD && echo "fix present"
Then read admin/user.php and look at what checkMailCode() clears after a successful check. If it clears a different session key than the one that stores the mail code, your build has the flaw.
Also look for behaviour that suggests misuse: repeated successful email verifications from one session, or password and email changes that you did not expect.
What to do now
- Update Emlog to a release that includes commit 1f726df, or apply the commit to your own fork.
- Confirm in
admin/user.phpthat the mail verification code is cleared from the session after a successful check. - Review recent account email changes and password resets for entries you cannot explain.
- Turn on rate limits and short expiry times for verification codes, so even a reused code has a short life.
- If you cannot update soon, reduce exposure by restricting the admin area to known networks.
Why it matters
A verification code proves that a person controls an inbox, but only once. The code has to be single use and short lived. Here the cleanup step cleared the wrong session variable, so the real code stayed valid after it had been used. That is an CWE-287 problem, improper authentication, caused by a one word mistake in a cleanup line.
The gap in severity between NVD and the project is worth reading carefully. NVD scored the network, no privilege vector at its highest reach. The maintainers judged the practical impact lower, likely because reuse needs a code to have been issued in the first place. Both views are useful. Patch it, and decide urgency from how your site uses email verification.
The record does not mark this CVE as CISA Known Exploited.
Quick check
Why is the project severity Low when NVD says 9.1?
The score in NVD comes from a generic vector. The maintainers rate it by practical impact in their code. The two are not required to match, so read the details and patch.
Is there a numbered fixed release?
I did not confirm one. The record names commit 1f726df, so look for the first Emlog release that contains it.
Sources
Last reviewed: 18 October 2026.
