CVE-2025-34412 Details

A vulnerability exists in the Convercent Whistleblowing Platform, managed by EQS Group, due to a failure in session and browser handling mechanisms. Affected deployments typically lack essential HTTP security headers, such as Content-Security-Policy and Referrer-Policy, and have inadequate clickjacking defenses. Additionally, the platform issues session cookies with insecure or inconsistent attributes, including duplicate ASP.NET_SessionId values, an affinity cookie without the Secure attribute, and mixed or absent SameSite settings. These vulnerabilities compromise session integrity and browser-side isolation, heightening the risk of client-side attacks, session fixation, and cross-site session leakage.

Convercent should implement modern security headers, revise its HSTS configuration, ensure proper session cookie management, enhance clickjacking protections, and address the customer enumeration vulnerability by securing the API endpoint.