CVE-2025-53826: File Browser’s insecure JWT handling can lead to session replay attacks after logout

File Browser’s authentication system issues long-lived JWT tokens that remain valid even after the user logs out. Please refer to the CWE’s listed in this report for further reference and system standards. In summary, the main issue is:

• Tokens remain valid after logout (session replay attacks)

In this report, I used docker as the documentation instruct:

docker run \
-v filebrowser_data:/srv \
-v filebrowser_database:/database \
-v filebrowser_config:/config \
-p 8080:80 \
filebrowser/filebrowser