CVE-2025-50488 describes an improper session invalidation vulnerability in PHPGurukul Online Library Management System v3.0, specifically in the /library/change-password.php component. Due to this vulnerability, sessions are not correctly invalidated after a password change, enabling attackers to hijack user sessions. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. No patch or official fix information is provided in the available data.

Successful exploitation can lead to session hijacking, allowing an attacker to gain unauthorized access to a user's session and potentially sensitive information. The confidentiality impact is high, while integrity impact is low and availability is unaffected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider additional session management controls such as enforcing session expiration on password changes and monitoring for suspicious session activity.