Live › vulnerability › CVE-2026-50000
SecureDrop's Journalist Interface stores API and web sessions in Redis with a mutable key prefix, so an API session token can be reused against the web UI until it expires (at most eight hours). An attacker who already holds a compromised journalist's valid, unexpired API token and knows the Journalist Interface onion address can act on source submissions, though plaintext submissions are not exposed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 17:31 UTC. All times on this page are UTC.
Media organizations and others running SecureDrop from version 2.5.0 up to 2.16.0 whose Journalist Interface is reachable by journalists. Exposure requires a compromised journalist's unexpired API session token, so instances without journalist API use are less exposed.
No product ranges from the sources yet.
2.5.0 through 2.16.0.2.16.0.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communicate with anonymous sources. From 2.5.0 until 2.16.0, the Journalist Interface can accept an API session token against the web UI because its SessionInterface keeps a mutable session key prefix that changes with each request and persists across requests. API and web sessions were separated in Redis starting in version 2.5.0, but prefix corruption confuses those session namespaces. An attacker who already has access to the secret Journalist Interface onion address, the required authentication access and a recent nonexpired API session token can reuse that token against the web UI until its natural expiry, at most eight hours. The corrupted prefix can also prevent logout from deleting the correct Redis session, although normal expiry still applies. A compromised journalist can access encrypted submissions and perform broad actions on source submissions, but this issue does not expose plaintext submissions or affect the running system's availability. This issue is fixed in version 2.16.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-50000")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.