OpenObserve up to 0.15.x Organization Invitation Token session expiration

Summaryinfo

A vulnerability, which was classified as problematic, has been found in OpenObserve up to 0.15.x. This affects an unknown part of the component Organization Invitation Token Handler. This manipulation causes session expiration. This vulnerability is registered as CVE-2025-66223. Remote exploitation of the attack is possible. No exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in OpenObserve up to 0.15.x. Affected by this vulnerability is an unknown functionality of the component Organization Invitation Token Handler. The manipulation with an unknown input leads to a session expiration vulnerability. The CWE definition for the vulnerability is CWE-613. According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization." As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

OpenObserve is a cloud-native observability platform. Prior to version 0.16.0, organization invitation tokens do not expire once issued, remain valid even after the invited user is removed from the organization, and allow multiple invitations to the same email with different roles where all issued links remain valid simultaneously. This results in broken access control where a removed or demoted user can regain access or escalate privileges. This issue has been patched in version 0.16.0.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2025-66223 since 11/25/2025. The exploitation appears to be easy. The attack can be launched remotely. The exploitation requires an enhanced level of successful authentication. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 0.16.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-199890). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• OpenObserve

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13
• 0.14
• 0.15

Website

• Product: https://github.com/openobserve/openobserve/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion