CVE-2025-35433
📋 TL;DR
CVE-2025-35433 is an authentication bypass vulnerability in CISA Thorium where previously used tokens remain valid after password resets. This allows attackers with old tokens to maintain access to accounts even after password changes. All Thorium deployments before version 1.1.1 are affected.
💻 Affected Systems
- CISA Thorium
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers maintain persistent access to compromised accounts even after victims change passwords, enabling continued data theft, privilege escalation, or lateral movement.
Likely Case
Attackers who previously obtained tokens through phishing, malware, or other means can maintain access to user accounts after password resets.
If Mitigated
With proper token expiration policies and monitoring, impact is limited to short windows of opportunity for attackers.
🎯 Exploit Status
Exploitation requires obtaining valid authentication tokens through other means first, then using them after password resets.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.1.1
Vendor Advisory: https://github.com/cisagov/thorium/releases/tag/1.1.1
Restart Required: No
Instructions:
1. Backup current Thorium configuration and data. 2. Download Thorium version 1.1.1 from official repository. 3. Replace existing installation with new version. 4. Verify all services are running correctly.
🔧 Temporary Workarounds
Force token invalidation on password reset
allManually invalidate all existing tokens when users reset passwords
# Requires custom implementation - no standard command available
🧯 If You Can't Patch
- Implement mandatory token rotation policies to expire tokens more frequently
- Enhance monitoring for unusual login patterns and token reuse
🔍 How to Verify
Check if Vulnerable:
Check Thorium version - if below 1.1.1, system is vulnerable. Test by resetting a password and attempting to use an old token.Check Version:
Check Thorium configuration or deployment manifest for version informationVerify Fix Applied:
After upgrading to 1.1.1, test that old tokens become invalid after password resets.📡 Detection & Monitoring
Log Indicators:
- Multiple successful logins with same token ID after password reset events
- Token reuse from different IP addresses after password changes
Network Indicators:
- Authentication requests using tokens that should be invalidated
SIEM Query:
source="thorium" AND (event="password_reset" OR event="token_validation") | stats count by user, token_id | where count > 1🔗 References
- https://github.com/cisagov/thorium/commit/7c94a0b9bc2dc55e0c307360452f348bac06820c#diff-57a8b13962b268bcc3690df0f6c0d6ddeca7cbc7b05c3c20903cb07e659330eaR844-R849
- https://github.com/cisagov/thorium/releases/tag/1.1.1
- https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-259-01.json
- https://www.cve.org/CVERecord?id=CVE-2025-35433
