---
id: "CVE-2026-86589"
kind: "vulnerability"
aliases: ["CVE-2026-86589"]
title: "Apache Answer: external login sessions skip suspension checks after account deletion"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["apache-answer", "runtime", "self-hosted", "user-center-login"]
not_affected_if: ["local-accounts-only", "patched-2.0.3"]
published_at: "2026-10-19T10:16:49+00:00"
first_seen_at: "2026-10-23T21:57:17+00:00"
updated_at: "2026-10-25T05:11:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86589", "first_seen_at": "2026-10-23T21:57:17+00:00"}]
---

# Apache Answer: external login sessions skip suspension checks after account deletion

A flaw in the User Center login integration creates sessions that omit the external identity, so later requests skip central account suspension or deletion checks. An attacker whose external account was suspended or deleted can keep using the Apache Answer session until it expires or is revoked.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Apache Answer version and whether it is `2.0.2` or earlier
- Confirm whether User Center (external login) integration is enabled in the deployment
- unknown for other checks, as the sources do not say

## Fix

- Upgrade Apache Answer to `2.0.3`
- Revoke existing sessions for users whose external accounts were suspended or deleted, as the sources do not say more

## Timeline

- 2026-10-23T21:57:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-86589

## From the sources

Incorrect implementation of authentication algorithm vulnerability in Apache Answer.



This issue affects Apache Answer: through 2.0.2.



A flaw in the User Center login integration can cause a newly created external user session to omit its external identity, allowing subsequent requests to bypass central account suspension or deletion checks until the session
  expires or is revoked.



Users are recommended to upgrade to version 2.0.3, which fixes the issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_