Live › vulnerability › CVE-2026-116894
Go to dashboardREDAXO before 5.21.5 does not invalidate the current session and stay-logged-in key when a user changes their password. An attacker who already holds a user's session id or stay-logged-in cookie keeps backend access after the password change, for up to three months via the cookie.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 11:31 UTC. All times on this page are UTC.
Sites running REDAXO CMS before 5.21.5 with a backend where users have logged in, especially where the stay-logged-in cookie is used. An attacker must first have obtained a session id or stay-logged-in cookie, for example through a stolen device or a leaked cookie. Sites on a fixed version, or with no backend users, can skip it.
No product ranges from the sources yet.
redaxo/src/core/boot.php or the version string in the backend, and see whether it is below 5.21.55.21.5 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
REDAXO before 5.21.5 contains an insufficient session expiration vulnerability that allows attackers to retain account access by keeping the current session and stay-logged-in key valid after a password change. Attackers who obtained a user's session id or stay-logged-in cookie can keep backend access after the password change, via the cookie for up to three months.
This page as .md · .json · in your agent: get_signal("CVE-2026-116894")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.