What is the CVSS score of CVE-2025-55264?

CVE-2025-55264 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Session Fixation are affected by CVE-2025-55264?

Organizations using HCL Aftermarket DPC should be aware of moderate risk from CVE-2025-55264 rated CVSS 5.5. Exploitation could compromise the security of affected deployments.

How to fix or mitigate CVE-2025-55264?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Session Fixation CVE-2025-55264

EUVD-2025-209085 MEDIUM

Insufficient Session Expiration (CWE-613)

2026-03-26 HCL

GHSA-m87p-2jxv-5xfp

Authentication Bypass Session Fixation Aftermarket Dpc

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 26, 2026 - 13:45 euvd

EUVD-2025-209085

Analysis Generated

Mar 26, 2026 - 13:45 vuln.today

CVE Published

Mar 26, 2026 - 13:04 nvd

MEDIUM 5.5

DescriptionCVE.org

HCL Aftermarket DPC is affected by Failure to Invalidate Session on Password Change will allow attacker to access to a session, then they can maintain control over the account despite the password change leading to account takeover.

AnalysisAI

Session invalidation failure in HCL Aftermarket DPC versions up to 1.0.0 allows authenticated attackers to maintain active sessions after a password change, enabling persistent account takeover. An attacker who gains initial session access can continue to operate under a compromised account identity even after the victim resets their password, as the application fails to terminate pre-existing sessions upon credential modification. No public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

The vulnerability stems from a session management implementation flaw classified under CWE-613 (Insufficient Session Expiration), where HCL Aftermarket DPC does not properly invalidate active HTTP sessions when a user changes their password. The affected product is identified via CPE cpe:2.3:a:hcl:aftermarket_dpc:*:*:*:*:*:*:*:*. Session tokens or cookies remain valid post-password-change because the application lacks server-side session lifecycle management tied to authentication credential events. This allows a threat actor with an existing authenticated session (established through credential compromise, phishing, or other means) to bypass the user's defensive action of password reset, maintaining unauthorized access to the account and its associated resources.

RemediationAI

Apply the security patch from HCL as described in their official advisory (https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0129793). The patch should address session invalidation logic to ensure all active sessions are terminated when a password change event occurs. Until patching is possible, mitigate by enforcing periodic session timeout policies (e.g., 30-60 minute inactivity windows) at the application level, implementing IP-based session pinning where feasible to detect session hijacking, and monitoring account activity logs for unexpected concurrent sessions. Additionally, require users to log out from all devices after a password change and implement multi-factor authentication (MFA) to add a second factor of control beyond session tokens.