The vulnerability is an insufficient session expiration flaw in Avantra’s metrics web server that permits reusing session identifiers. An attacker can capture a valid session ID and replay it to gain unauthorized access, potentially assuming the privileges of the original user. This flaw enables unauthorized confidentiality and integrity breaches if the compromised session grants access to sensitive administrative functions.

The affected product is Avantra from syslink software AG. All deployments running any version prior to 25.3.1 on Linux or Windows are impacted. No specific service version details are provided beyond the major release number.

The CVSS score of 9.6 indicates a critical severity. Although the EPSS score is not available, the vulnerability’s nature suggests that a remote attacker with network access to the Avantra web interface could exploit it. The issue is not listed in the CISA KEV catalog. Because the flaw permits session replay over the network, it is likely a remote attack vector involving standard web traffic, and the risk to systems that expose the metrics web server to untrusted networks is high.