CVE-2025-63563
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
Summer Pearl Group Vacation Rental Management Platform prior to v1.0.2 does not properly invalidate active user sessions after a password change. This allows an attacker with a valid session token to maintain access to the account even after the legitimate user changes their password.
Risk Assessment
An attacker with a stolen session token could continue using the account despite the owner changing the password, complicating incident response. The risk affects the security of platform user accounts.
Recommendation
Update the platform to version 1.0.2 or later, which properly invalidates sessions after a password change. Implement invalidation of all active sessions upon credential changes.
Other vulnerabilities in Summer Pearl Group Vacation Rental Management Platform
See all- CVE-2025-63562Medium
Summer Pearl Group Vacation Rental Management Platform prior to v1.0.2 suffers from insufficient server-side authorization. Authenticated attackers can call several endpoints and perform create/update/delete actions on resources owned by arbitrary users by manipulating request parameters (e.g., owner or resource id).
- CVE-2025-63561High
Summer Pearl Group Vacation Rental Management Platform prior to 1.0.2 is susceptible to a Slowloris-style Denial-of-Service (DoS) condition in the HTTP connection handling layer, where an attacker that opens and maintains many slow or partially-completed HTTP connections can exhaust the server's connection pool and worker capacity, preventing legitimate users and APIs from accessing the service.
Original NVD description (English source)
Summer Pearl Group Vacation Rental Management Platform prior to v1.0.2 does not properly invalidate active user sessions after a password change. This allows an attacker with a valid session token to maintain access to the account even after the legitimate user changes their password.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS