UpHeron
All vulnerabilities

Servers and applications

CVE-2025-55162

oAuth2 Filter Signout route will not clear cookies because of missing "secure;" flag

Severity
High 8.8
Published
2 Sept 2025
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.32.10, 1.34.5
Also known as
GHSA-95j4-hw7f-v2rh
Sources
NVD, Project advisories (GitHub)

Description

Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In versions below 1.32.10 and 1.33.0 through 1.33.6, 1.34.0 through 1.34.4 and 1.35.0, insufficient Session Expiration in the Envoy OAuth2 filter leads to failed logout operations. When configured with __Secure- or __Host- prefixed cookie names, the filter fails to append the required…

Affected software

SoftwareAffected versions
EnvoyServers and applications · cpe:a:envoyproxy:envoy
  • Every version before 1.32.10
  • From 1.33.0 up to 1.33.7
  • From 1.34.0 before 1.34.5
  • Version 1.35.0
EnvoyServers and applications · github:envoyproxy/envoy
  • Every version before 1.32.10

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-55162
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-55162
  • GitHub Advisory Database https://github.com/advisories/GHSA-95j4-hw7f-v2rh
  • github.com https://github.com/envoyproxy/envoy/security/advisories/GHSA-95j4-hw7f-v2rh