---
id: "CVE-2026-116894"
kind: "vulnerability"
aliases: ["CVE-2026-116894"]
title: "REDAXO CMS: old sessions survive password change for up to three months"
severity: "medium"
cvss: 4.2
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["cms", "php", "redaxo", "runtime", "self-hosted"]
not_affected_if: ["fixed-version", "no-backend-users"]
published_at: "2026-10-27T11:17:32+00:00"
first_seen_at: "2026-10-27T11:31:27+00:00"
updated_at: "2026-10-27T11:32:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116894", "first_seen_at": "2026-10-27T11:31:27+00:00"}]
---

# REDAXO CMS: old sessions survive password change for up to three months

REDAXO before 5.21.5 does not invalidate the current session and stay-logged-in key when a user changes their password. An attacker who already holds a user's session id or stay-logged-in cookie keeps backend access after the password change, for up to three months via the cookie.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed REDAXO version in the project's core files, e.g. `redaxo/src/core/boot.php` or the version string in the backend, and see whether it is below `5.21.5`
- Confirm whether the backend 'stay logged in' option is enabled for users

## Fix

- Upgrade REDAXO to `5.21.5` or later
- After upgrading, log out all backend users or rotate their stay-logged-in keys, since existing cookies may remain valid until they are revoked

## Timeline

- 2026-10-27T11:31:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116894

## From the sources

REDAXO before 5.21.5 contains an insufficient session expiration vulnerability that allows attackers to retain account access by keeping the current session and stay-logged-in key valid after a password change. Attackers who obtained a user's session id or stay-logged-in cookie can keep backend access after the password change, via the cookie for up to three months.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_