Turbo
1 CVEs
product
Monthly
Race condition in the turbo-frame element handler in Hotwired Turbo before 8.0.x causes logout operations to fail when delayed frame responses reapply session cookies after logout. This can be exploited by remote attackers via selective network delays (e.g. [CVSS 4.8 MEDIUM]
Race Condition
Turbo
NVD
GitHub
CVSS 3.1
4.8
EPSS
0.1%
CVE-2025-66803
EPSS 0%
CVSS 4.8
MEDIUM
POC
PATCH
This Month
Race condition in the turbo-frame element handler in Hotwired Turbo before 8.0.x causes logout operations to fail when delayed frame responses reapply session cookies after logout. This can be exploited by remote attackers via selective network delays (e.g. [CVSS 4.8 MEDIUM]
Race Condition
Turbo
NVD
GitHub