CVE-2025-50491 describes an improper session invalidation vulnerability (CWE-613) in PHPGurukul Bank Locker Management System version 1, specifically in the /banker/change-password.php component. The vulnerability allows an attacker to hijack user sessions because the system does not correctly invalidate the session after a password change operation. This could enable unauthorized access to user accounts without requiring credentials. The CVSS 3.1 vector indicates the attack can be performed remotely over the network without privileges and requires user interaction, with high confidentiality impact and low integrity impact.

Successful exploitation of this vulnerability can lead to session hijacking, allowing attackers to gain unauthorized access to user accounts and sensitive information. Confidentiality is highly impacted, while integrity impact is low and availability is not affected. This could compromise user data and banking operations managed by the affected system.

No official patch or fix is currently available for this vulnerability. Users and administrators should monitor the vendor's advisory channels for updates. In the meantime, consider implementing additional session management controls such as forcing full logout and session termination after password changes, and enforcing short session timeouts to reduce risk.