Live › vulnerability › CVE-2026-86589
Go to dashboardA flaw in the User Center login integration creates sessions that omit the external identity, so later requests skip central account suspension or deletion checks. An attacker whose external account was suspended or deleted can keep using the Apache Answer session until it expires or is revoked.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Deployments of Apache Answer through 2.0.2 that use the User Center login integration for external users. Sites that sign users in only with local accounts are not described as affected. Teams using the fixed release can skip it.
2.0.3No product ranges from the sources yet.
2.0.2 or earlier2.0.3Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Incorrect implementation of authentication algorithm vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.2.
A flaw in the User Center login integration can cause a newly created external user session to omit its external identity, allowing subsequent requests to bypass central account suspension or deletion checks until the session expires or is revoked.
Users are recommended to upgrade to version 2.0.3, which fixes the issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-86589")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.