Hospital Management System CVE-2025-11609

The vulnerability requires that express-session is integrated into Hospital Management System 1.0 with a hardcoded secret parameter in the configuration. Exploitation occurs when the attacker gains knowledge of the hardcoded secret, which may be obtained through source code disclosure, GitHub repository inspection, or security documentation. The secret must not be overridden by environment-specific configuration at runtime. Exploitation is limited to information disclosure; attackers cannot modify application data or execute arbitrary code. The attack does not require authentication or user interaction but does require high technical complexity to derive the secret or forge valid session tokens.

Real-world risk is low despite information disclosure impact. The CVSS 4.0 vector shows AV:N (network attack) but AC:H (high complexity) and AT:N (no user interaction required), which appears contradictory-the high complexity qualifier significantly reduces practical exploitability. EPSS score of 0.19% at percentile 41 indicates minimal probability of exploitation in the wild, placing this below the median for publicly disclosed vulnerabilities. No CISA KEV listing is indicated, confirming no active widespread exploitation. However, publicly available exploit code exists, meaning the barrier to exploitation is reduced for motivated threat actors. The vulnerability's impact is limited to information disclosure (VI:L) with no integrity or availability impact, suggesting attackers could read session data but not modify application state. Risk assessment should weight this as low priority unless Hospital Management System 1.0 is deployed in a healthcare environment with highly sensitive patient data; in such contexts, even limited information disclosure warrants remediation.

An attacker obtains the hardcoded secret from Hospital Management System 1.0 source code or documentation. Using this secret, the attacker crafts a valid session cookie by signing it with the known secret, then sends it to a targeted user's browser via social engineering or network interception. The application accepts the forged cookie as legitimate, allowing the attacker to assume the user's session identity and access sensitive patient data or hospital records without authentication.