nopCommerce Flaw (CVE-2025-11699) Allows Admin Takeover by Reusing Session Cookies After Logout

A security advisory has revealed a vulnerability in nopCommerce, CVE-2025-11699, that could allow an attacker to hijack administrator accounts by reusing session cookies after logout. The flaw stems from nopCommerce failing to invalidate session cookies upon logout or session termination, meaning a captured cookie can still grant access to the application.

The CERT/CC vulnerability note states that the session cookie can be obtained via XSS, network interception, or local compromise and reused after the user has logged out, effectively bypassing authentication. The issue affects Version 4.70 and prior, as well as Version 4.80.3; administrators are urged to upgrade to the latest version, 4.90.3, as soon as possible, while any version above 4.70 but excluding 4.80.3 is considered safe.

The advisory also notes that this flaw is extremely similar to CVE-2019-7215, and emphasises the potential for attackers to access privileged endpoints such as /admin, with possible financial or ransomware impacts.