CVE-2026-116894

Publié : 27 octobre 2026

Modifié : 27 octobre 2026

Score CVSS

4.2

MEDIUM

Description détaillée

REDAXO before 5.21.5 contains an insufficient session expiration vulnerability that allows attackers to retain account access by keeping the current session and stay-logged-in key valid after a password change. Attackers who obtained a user's session id or stay-logged-in cookie can keep backend access after the password change, via the cookie for up to three months.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Références et Patchs

https://github.com/redaxo/core/commit/672d22a779bfce7aa4aa445d9c831a824fb86896 https://github.com/redaxo/core/security/advisories/GHSA-mjjv-vffq-g5h6 https://www.vulncheck.com/advisories/redaxo-before-5.21.5-insufficient-session-expiration-on-password-change

Dernières Vulnérabilités

CVE-2026-92546

Authentication bypass by spoofing vulnerability in Keepnet Labs Cybersecurity Inc. Agentic AI / Agentic Ally allows Authentication Bypass. This issue affects Agentic AI / Agentic Ally: before 0ef61f2e.

VOIR DÉTAILS

CVE-2026-65151

NVIDIA NeMo Agent Toolkit contains vulnerability where an attacker could cause a SQL injection issue. A successful exploit of this vulnerability might lead to data tampering, denial of service and information disclosure.

VOIR DÉTAILS

CVE-2026-65145

NVIDIA NeMo Agent Toolkit contains a vulnerability where a attacker could cause a missing authentication issue. This vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure.

VOIR DÉTAILS