Common Weakness Enumeration
CWE-613
Allowed-with-ReviewInsufficient Session Expiration
Abstraction: Base · Status: Incomplete
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
502 vulnerabilities reference this CWE, most recent first.
CVE-2026-123813 (GCVE-0-2026-123813)
Vulnerability from cvelistv5 – Published: 2026-11-09 21:07 – Updated: 2026-11-09 21:07
VLAI
EPSS
VEX
Title
pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's session
Summary
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev102, pyLoad does not invalidate existing Flask sessions when an administrator changes a user's permissions or password through /api/set_user_permission or /api/change_password. Api.set_user_permission and Api.change_password update the database, but session authorization continues to use role and permission values copied at login by set_session in webui/app/helpers.py. A user can therefore retain revoked privileges or continue using a session established with an old password for the configured session lifetime. API-key authentication is not affected because that path rereads user data from the database. This issue is fixed in version 0.5.0b3.dev102.
Severity
7.5 (High)
CWE
- CWE-613 - Insufficient Session Expiration
Assigner
GitHub_M
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/pyload/pyload/security/advisor… | x_refsource_CONFIRM |
| https://github.com/pyload/pyload/commit/3e726ba27… | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "pyload",
"vendor": "pyload",
"versions": [
{
"status": "affected",
"version": "\u003c 0.5.0b3.dev102"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev102, pyLoad does not invalidate existing Flask sessions when an administrator changes a user\u0027s permissions or password through /api/set_user_permission or /api/change_password. Api.set_user_permission and Api.change_password update the database, but session authorization continues to use role and permission values copied at login by set_session in webui/app/helpers.py. A user can therefore retain revoked privileges or continue using a session established with an old password for the configured session lifetime. API-key authentication is not affected because that path rereads user data from the database. This issue is fixed in version 0.5.0b3.dev102."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-613",
"description": "CWE-613: Insufficient Session Expiration",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T21:07:55.582Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/pyload/pyload/security/advisories/GHSA-jq7h-wrvp-3rgx",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pyload/pyload/security/advisories/GHSA-jq7h-wrvp-3rgx"
},
{
"name": "https://github.com/pyload/pyload/commit/3e726ba271a6b1015e3a0ea6dc7e46a8f71a62ad",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pyload/pyload/commit/3e726ba271a6b1015e3a0ea6dc7e46a8f71a62ad"
}
],
"source": {
"advisory": "GHSA-jq7h-wrvp-3rgx",
"discovery": "UNKNOWN"
},
"title": "pyLoad: Privilege revocation and password change through the REST API do not invalidate the user\u0027s session"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-123813",
"datePublished": "2026-11-09T21:07:55.582Z",
"dateReserved": "2026-11-06T15:27:56.226Z",
"dateUpdated": "2026-11-09T21:07:55.582Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123804 (GCVE-0-2026-123804)
Vulnerability from cvelistv5 – Published: 2026-11-09 18:53 – Updated: 2026-11-09 18:53
VLAI
EPSS
VEX
Title
SuperTokens Core: A session created concurrently with account unlink survives the unlink
Summary
SuperTokens Core is an open source authentication server. From 7.0.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, createNewSession can resolve a primary user before unlinkAccounts detaches a login method and then insert the session after unlink has enumerated and revoked the existing sessions. A user who controls the linked login method can exploit this race to retain a signed, database-backed, refreshable session as the former primary identity after that method is unlinked; the session persists until expiry or explicit revocation. This issue is fixed in versions 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1.
Severity
6.8 (Medium)
CWE
Assigner
GitHub_M
CNA
References
21 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| supertokens | supertokens-core |
Affected:
>= 7.0.0, < 11.0.0
Affected: >= 11.0.0, < 11.0.9 Affected: >= 11.1.0, < 11.1.4 Affected: >= 11.2.0, < 11.2.4 Affected: >= 11.3.0, < 11.3.8 Affected: >= 11.4.0, < 11.4.8 Affected: >= 12.0.0, < 12.0.11 Affected: >= 12.1.0, < 12.1.2 Affected: >= 12.2.0, < 12.2.1 Affected: >= 12.3.0, < 12.3.1 |
{
"containers": {
"cna": {
"affected": [
{
"product": "supertokens-core",
"vendor": "supertokens",
"versions": [
{
"status": "affected",
"version": "\u003e= 7.0.0, \u003c 11.0.0"
},
{
"status": "affected",
"version": "\u003e= 11.0.0, \u003c 11.0.9"
},
{
"status": "affected",
"version": "\u003e= 11.1.0, \u003c 11.1.4"
},
{
"status": "affected",
"version": "\u003e= 11.2.0, \u003c 11.2.4"
},
{
"status": "affected",
"version": "\u003e= 11.3.0, \u003c 11.3.8"
},
{
"status": "affected",
"version": "\u003e= 11.4.0, \u003c 11.4.8"
},
{
"status": "affected",
"version": "\u003e= 12.0.0, \u003c 12.0.11"
},
{
"status": "affected",
"version": "\u003e= 12.1.0, \u003c 12.1.2"
},
{
"status": "affected",
"version": "\u003e= 12.2.0, \u003c 12.2.1"
},
{
"status": "affected",
"version": "\u003e= 12.3.0, \u003c 12.3.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "SuperTokens Core is an open source authentication server. From 7.0.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, createNewSession can resolve a primary user before unlinkAccounts detaches a login method and then insert the session after unlink has enumerated and revoked the existing sessions. A user who controls the linked login method can exploit this race to retain a signed, database-backed, refreshable session as the former primary identity after that method is unlinked; the session persists until expiry or explicit revocation. This issue is fixed in versions 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-613",
"description": "CWE-613: Insufficient Session Expiration",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T18:53:24.985Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/supertokens/supertokens-core/security/advisories/GHSA-2pc4-vw9j-454c",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/supertokens/supertokens-core/security/advisories/GHSA-2pc4-vw9j-454c"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/182b39454ac44649cdef22d87f296a38a0b1a602",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/182b39454ac44649cdef22d87f296a38a0b1a602"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/378e1157dc26232a518d2c360ee60cf93c2fd8a2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/378e1157dc26232a518d2c360ee60cf93c2fd8a2"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/5aec64aca6d765cde491658210e6922e291742fd",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/5aec64aca6d765cde491658210e6922e291742fd"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/b1c569ed59fffe16c2f657da1754abcae47d2761",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/b1c569ed59fffe16c2f657da1754abcae47d2761"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/b44f1e1418206f411e541501c2e5b9b147add0d9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/b44f1e1418206f411e541501c2e5b9b147add0d9"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/bb6d5f8d1b79770e3cc37f214ba94c3e36e9c3b8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/bb6d5f8d1b79770e3cc37f214ba94c3e36e9c3b8"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/c0b7f5eda20840f63f6b0f171d22bd49a7a609a1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/c0b7f5eda20840f63f6b0f171d22bd49a7a609a1"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/c8b48e843b323cd749dcb17b6b81c190e7882a43",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/c8b48e843b323cd749dcb17b6b81c190e7882a43"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/c950a01794cf0983ebd62412976cb80756bf5dd0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/c950a01794cf0983ebd62412976cb80756bf5dd0"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/d456dfbc02f2f7d68be7c05d876bdaa086f9a5b5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/d456dfbc02f2f7d68be7c05d876bdaa086f9a5b5"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/fc273f5157d3e96f147aa42773607d627d3b495f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/fc273f5157d3e96f147aa42773607d627d3b495f"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v11.0.9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v11.0.9"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v11.1.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v11.1.4"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v11.2.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v11.2.4"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v11.3.8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v11.3.8"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v11.4.8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v11.4.8"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v12.0.11",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v12.0.11"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v12.1.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v12.1.2"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v12.2.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v12.2.1"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v12.3.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v12.3.1"
}
],
"source": {
"advisory": "GHSA-2pc4-vw9j-454c",
"discovery": "UNKNOWN"
},
"title": "SuperTokens Core: A session created concurrently with account unlink survives the unlink"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-123804",
"datePublished": "2026-11-09T18:53:24.985Z",
"dateReserved": "2026-11-06T15:27:56.226Z",
"dateUpdated": "2026-11-09T18:53:24.985Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123799 (GCVE-0-2026-123799)
Vulnerability from cvelistv5 – Published: 2026-11-09 18:07 – Updated: 2026-11-09 22:58
VLAI
EPSS
VEX
Title
SuperTokens Core: Dashboard session tokens are never checked for expiry: `isValidUserSession` ignores the stored `expiry`, so a long-expired admin session still authenticates
Summary
SuperTokens Core is an open source authentication server. From 11.0.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, and 12.1.2, Dashboard.isValidUserSession treats any stored session row as valid without comparing DashboardSessionInfo.expiry to the current time. DashboardQueries.getSessionInfoWithSessionId also selects by app and session identifier without an expiry predicate, leaving the periodic DeleteExpiredDashboardSessions cleanup as the only expiration enforcement. An attacker who obtains a dashboard administrator session after its 30-day lifetime can continue using POST /recipe/dashboard/session/verify until the row is removed, and frequent Core restarts can prevent the 12-hour cleanup sweep from running. The stale session retains full dashboard read and write access, but the flaw does not provide a way to guess or acquire the random session identifier. This issue is fixed in versions 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, and 12.1.2.
Severity
7.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 22:58 UTC
CWE
- CWE-613 - Insufficient Session Expiration
Assigner
GitHub_M
CNA
References
17 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| supertokens | supertokens-core |
Affected:
>= 11.0.0, < 11.0.9
Affected: >= 11.1.0, < 11.1.4 Affected: >= 11.2.0, < 11.2.4 Affected: >= 11.3.0, < 11.3.8 Affected: >= 11.4.0, < 11.4.8 Affected: >= 12.0.0, < 12.0.11 Affected: >= 12.1.0, < 12.1.2 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-123799",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T22:58:04.469475Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T22:58:19.719Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "supertokens-core",
"vendor": "supertokens",
"versions": [
{
"status": "affected",
"version": "\u003e= 11.0.0, \u003c 11.0.9"
},
{
"status": "affected",
"version": "\u003e= 11.1.0, \u003c 11.1.4"
},
{
"status": "affected",
"version": "\u003e= 11.2.0, \u003c 11.2.4"
},
{
"status": "affected",
"version": "\u003e= 11.3.0, \u003c 11.3.8"
},
{
"status": "affected",
"version": "\u003e= 11.4.0, \u003c 11.4.8"
},
{
"status": "affected",
"version": "\u003e= 12.0.0, \u003c 12.0.11"
},
{
"status": "affected",
"version": "\u003e= 12.1.0, \u003c 12.1.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "SuperTokens Core is an open source authentication server. From 11.0.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, and 12.1.2, Dashboard.isValidUserSession treats any stored session row as valid without comparing DashboardSessionInfo.expiry to the current time. DashboardQueries.getSessionInfoWithSessionId also selects by app and session identifier without an expiry predicate, leaving the periodic DeleteExpiredDashboardSessions cleanup as the only expiration enforcement. An attacker who obtains a dashboard administrator session after its 30-day lifetime can continue using POST /recipe/dashboard/session/verify until the row is removed, and frequent Core restarts can prevent the 12-hour cleanup sweep from running. The stale session retains full dashboard read and write access, but the flaw does not provide a way to guess or acquire the random session identifier. This issue is fixed in versions 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, and 12.1.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-613",
"description": "CWE-613: Insufficient Session Expiration",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T18:07:37.939Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/supertokens/supertokens-core/security/advisories/GHSA-w9fp-wv6g-pqv8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/supertokens/supertokens-core/security/advisories/GHSA-w9fp-wv6g-pqv8"
},
{
"name": "https://github.com/supertokens/supertokens-core/pull/1409",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/pull/1409"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/0f4817152278b39fbf21b97c3795b4fc68c12c38",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/0f4817152278b39fbf21b97c3795b4fc68c12c38"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/4b315b2382c8eec2cde28fbda113597bffad8da5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/4b315b2382c8eec2cde28fbda113597bffad8da5"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/699d806b5fc77ee6343f8e48e0769dce8049b078",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/699d806b5fc77ee6343f8e48e0769dce8049b078"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/8906b840669b28b3af7367cf18870db0044d0d18",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/8906b840669b28b3af7367cf18870db0044d0d18"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/bd8eb93001cf814a8065e8f3cea755af267bc308",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/bd8eb93001cf814a8065e8f3cea755af267bc308"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/ced1c913d53641e5eb8108caef110e55348b5401",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/ced1c913d53641e5eb8108caef110e55348b5401"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/da0ec91d20ecbb68730741f8b0dec8c986b68877",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/da0ec91d20ecbb68730741f8b0dec8c986b68877"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/e72793ec5bd925fd3b9ff19328043dc2a03201bd",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/e72793ec5bd925fd3b9ff19328043dc2a03201bd"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v11.0.9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v11.0.9"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v11.1.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v11.1.4"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v11.2.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v11.2.4"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v11.3.8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v11.3.8"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v11.4.8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v11.4.8"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v12.0.11",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v12.0.11"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v12.1.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v12.1.2"
}
],
"source": {
"advisory": "GHSA-w9fp-wv6g-pqv8",
"discovery": "UNKNOWN"
},
"title": "SuperTokens Core: Dashboard session tokens are never checked for expiry: `isValidUserSession` ignores the stored `expiry`, so a long-expired admin session still authenticates"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-123799",
"datePublished": "2026-11-09T18:07:37.939Z",
"dateReserved": "2026-11-06T15:27:56.225Z",
"dateUpdated": "2026-11-09T22:58:19.719Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123598 (GCVE-0-2026-123598)
Vulnerability from cvelistv5 – Published: 2026-11-08 01:38 – Updated: 2026-11-09 13:53
VLAI
EPSS
VEX
Title
Hickory DNS 0.25.0 through 0.26.0-alpha.1 DNSSEC Bogus Answer Cache Poisoning
Summary
The validating recursor in Hickory DNS hickory-recursor 0.25.0 through 0.26.0-alpha.1, hickory-resolver 0.26.0-alpha.1 before 0.26.2, and hickory-net 0.26.0-beta.1 before 0.26.2 caches DNSSEC-bogus answers using the untrusted, attacker-supplied record TTL (capped at 24 hours) instead of a short validation-failure TTL. A remote attacker who spoofs a single authoritative response with an invalid signature and a long TTL can keep the bogus result cached for up to 24 hours.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 13:53 UTC
CWE
- CWE-613 - Insufficient Session Expiration
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/hickory-dns/hickory-dns/securi… | vendor-advisory |
| https://www.vulncheck.com/advisories/hickory-dns-… | third-party-advisory |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| hickory-dns | hickory-dns |
Affected:
0.25.0 , ≤ 0.26.0-alpha.1
(semver)
|
|
| hickory-dns | hickory-dns |
Affected:
0.26.0-alpha.1 , < 0.26.2
(semver)
Unaffected: 0.26.2 (semver) |
|
| hickory-dns | hickory-dns |
Affected:
0.26.0-beta.1 , < 0.26.2
(semver)
Unaffected: 0.26.2 (semver) |
Date Public
2026-09-03 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-123598",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T13:53:19.210788Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T13:53:29.625Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:cargo/hickory-recursor",
"product": "hickory-dns",
"vendor": "hickory-dns",
"versions": [
{
"lessThanOrEqual": "0.26.0-alpha.1",
"status": "affected",
"version": "0.25.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:cargo/hickory-resolver",
"product": "hickory-dns",
"vendor": "hickory-dns",
"versions": [
{
"lessThan": "0.26.2",
"status": "affected",
"version": "0.26.0-alpha.1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "0.26.2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:cargo/hickory-net",
"product": "hickory-dns",
"vendor": "hickory-dns",
"versions": [
{
"lessThan": "0.26.2",
"status": "affected",
"version": "0.26.0-beta.1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "0.26.2",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "qifan-sailboat"
}
],
"datePublic": "2026-09-03T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The validating recursor in Hickory DNS hickory-recursor 0.25.0 through 0.26.0-alpha.1, hickory-resolver 0.26.0-alpha.1 before 0.26.2, and hickory-net 0.26.0-beta.1 before 0.26.2 caches DNSSEC-bogus answers using the untrusted, attacker-supplied record TTL (capped at 24 hours) instead of a short validation-failure TTL. A remote attacker who spoofs a single authoritative response with an invalid signature and a long TTL can keep the bogus result cached for up to 24 hours."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-613",
"description": "Insufficient Session Expiration",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T01:38:27.111Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-29q9-p769-j8gq)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-29q9-p769-j8gq"
},
{
"name": "VulnCheck Advisory: Hickory DNS 0.25.0 through 0.26.0-alpha.1 DNSSEC Bogus Answer Cache Poisoning",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/hickory-dns-0.25.0-through-0.26.0-alpha.1-dnssec-bogus-answer-cache-poisoning"
}
],
"title": "Hickory DNS 0.25.0 through 0.26.0-alpha.1 DNSSEC Bogus Answer Cache Poisoning",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-123598",
"datePublished": "2026-11-08T01:38:27.111Z",
"dateReserved": "2026-11-06T01:00:16.506Z",
"dateUpdated": "2026-11-09T13:53:29.625Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123597 (GCVE-0-2026-123597)
Vulnerability from cvelistv5 – Published: 2026-11-08 01:38 – Updated: 2026-11-08 01:38
VLAI
EPSS
VEX
Title
Hickory DNS DNSSEC Validation Cache Poisoning via Transient DS-Fetch Errors
Summary
Hickory DNS hickory-proto 0.25.0-alpha.1 through 0.26.0-alpha.1 and hickory-net before 0.26.2 contain a logic bug in DnssecDnsHandle's DS-fetch path that caches transient DS lookup errors as Bogus DNSSEC validation verdicts. An attacker who induces a SERVFAIL, REFUSED, or timeout response to a child-zone DS sub-query causes the validator to return SERVFAIL for all names under that zone until the cache entry's TTL expires.
Severity
CWE
- CWE-613 - Insufficient Session Expiration
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/hickory-dns/hickory-dns/securi… | vendor-advisory |
| https://www.vulncheck.com/advisories/hickory-dns-… | third-party-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| hickory-dns | hickory-dns |
Affected:
0.25.0-alpha.1 , ≤ 0.26.0-alpha.1
(semver)
|
|
| hickory-dns | hickory-dns |
Affected:
0.26.0-beta.1 , < 0.26.2
(semver)
Unaffected: 0.26.2 (semver) |
Date Public
2026-09-03 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:cargo/hickory-proto",
"product": "hickory-dns",
"vendor": "hickory-dns",
"versions": [
{
"lessThanOrEqual": "0.26.0-alpha.1",
"status": "affected",
"version": "0.25.0-alpha.1",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:cargo/hickory-net",
"product": "hickory-dns",
"vendor": "hickory-dns",
"versions": [
{
"lessThan": "0.26.2",
"status": "affected",
"version": "0.26.0-beta.1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "0.26.2",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "qifan-sailboat"
}
],
"datePublic": "2026-09-03T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Hickory DNS hickory-proto 0.25.0-alpha.1 through 0.26.0-alpha.1 and hickory-net before 0.26.2 contain a logic bug in DnssecDnsHandle\u0027s DS-fetch path that caches transient DS lookup errors as Bogus DNSSEC validation verdicts. An attacker who induces a SERVFAIL, REFUSED, or timeout response to a child-zone DS sub-query causes the validator to return SERVFAIL for all names under that zone until the cache entry\u0027s TTL expires."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-613",
"description": "Insufficient Session Expiration",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T01:38:26.431Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-xv7c-h5g9-x25x)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-xv7c-h5g9-x25x"
},
{
"name": "VulnCheck Advisory: Hickory DNS DNSSEC Validation Cache Poisoning via Transient DS-Fetch Errors",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/hickory-dns-dnssec-validation-cache-poisoning-via-transient-ds-fetch-errors"
}
],
"title": "Hickory DNS DNSSEC Validation Cache Poisoning via Transient DS-Fetch Errors",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-123597",
"datePublished": "2026-11-08T01:38:26.431Z",
"dateReserved": "2026-11-06T01:00:16.505Z",
"dateUpdated": "2026-11-08T01:38:26.431Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123528 (GCVE-0-2026-123528)
Vulnerability from cvelistv5 – Published: 2026-11-08 01:37 – Updated: 2026-11-08 01:37
VLAI
EPSS
VEX
Title
Vikunja before 2.7.1 Insufficient Session Expiration via HTTP Token Middleware
Summary
Vikunja before 2.7.1 contains an insufficient session expiration vulnerability that allows holders of revoked access tokens to keep authenticating because SetupTokenMiddleware skips session and account-status checks. Attackers with a stolen token can, after logout, password reset, or account disabling, mint OAuth sessions via /oauth/authorize or tk_ API tokens for persistent access.
Severity
CWE
- CWE-613 - Insufficient Session Expiration
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/go-vikunja/vikunja/security/ad… | vendor-advisory |
| https://www.vulncheck.com/advisories/vikunja-befo… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| go-vikunja | vikunja |
Affected:
0 , < 2.7.1
(semver)
Unaffected: 2.7.1 (semver) cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:* |
Date Public
2026-10-22 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/code.vikunja.io/api",
"product": "vikunja",
"vendor": "go-vikunja",
"versions": [
{
"lessThan": "2.7.1",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.7.1",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.7.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "r1alfarraj"
}
],
"datePublic": "2026-10-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Vikunja before 2.7.1 contains an insufficient session expiration vulnerability that allows holders of revoked access tokens to keep authenticating because SetupTokenMiddleware skips session and account-status checks. Attackers with a stolen token can, after logout, password reset, or account disabling, mint OAuth sessions via /oauth/authorize or tk_ API tokens for persistent access."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-613",
"description": "Insufficient Session Expiration",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T01:37:36.960Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-4qvp-948j-4cgv)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-4qvp-948j-4cgv"
},
{
"name": "VulnCheck Advisory: Vikunja before 2.7.1 Insufficient Session Expiration via HTTP Token Middleware",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/vikunja-before-2.7.1-insufficient-session-expiration-via-http-token-middleware"
}
],
"title": "Vikunja before 2.7.1 Insufficient Session Expiration via HTTP Token Middleware",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-123528",
"datePublished": "2026-11-08T01:37:36.960Z",
"dateReserved": "2026-11-06T00:48:01.381Z",
"dateUpdated": "2026-11-08T01:37:36.960Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123493 (GCVE-0-2026-123493)
Vulnerability from cvelistv5 – Published: 2026-11-08 01:37 – Updated: 2026-11-08 01:37
VLAI
EPSS
VEX
Title
Vikunja from 2.4.0 before 2.7.1 Authentication Bypass via Bot API Tokens
Summary
Vikunja from 2.4.0 before 2.7.1 contains an authentication bypass vulnerability that allows disabled or locked users to retain access through API tokens owned by their bot users. Because token validation only checks the bot's own status, attackers holding pre-minted bot tokens can keep reading and modifying shared projects via the HTTP API, CalDAV, MCP and feeds.
Severity
5.4 (Medium)
CWE
- CWE-613 - Insufficient Session Expiration
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/go-vikunja/vikunja/security/ad… | vendor-advisory |
| https://www.vulncheck.com/advisories/vikunja-from… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| go-vikunja | vikunja |
Affected:
2.4.0 , < 2.7.1
(semver)
Unaffected: 2.7.1 (semver) cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:* |
Date Public
2026-10-22 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/code.vikunja.io/api",
"product": "vikunja",
"vendor": "go-vikunja",
"versions": [
{
"lessThan": "2.7.1",
"status": "affected",
"version": "2.4.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.7.1",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.7.1",
"versionStartIncluding": "2.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Cuong-VnC"
}
],
"datePublic": "2026-10-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Vikunja from 2.4.0 before 2.7.1 contains an authentication bypass vulnerability that allows disabled or locked users to retain access through API tokens owned by their bot users. Because token validation only checks the bot\u0027s own status, attackers holding pre-minted bot tokens can keep reading and modifying shared projects via the HTTP API, CalDAV, MCP and feeds."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-613",
"description": "Insufficient Session Expiration",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T01:37:12.159Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-5fc2-w2j4-6r8w)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-5fc2-w2j4-6r8w"
},
{
"name": "VulnCheck Advisory: Vikunja from 2.4.0 before 2.7.1 Authentication Bypass via Bot API Tokens",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/vikunja-from-2.4.0-before-2.7.1-authentication-bypass-via-bot-api-tokens"
}
],
"title": "Vikunja from 2.4.0 before 2.7.1 Authentication Bypass via Bot API Tokens",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-123493",
"datePublished": "2026-11-08T01:37:12.159Z",
"dateReserved": "2026-11-06T00:44:37.659Z",
"dateUpdated": "2026-11-08T01:37:12.159Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121735 (GCVE-0-2026-121735)
Vulnerability from cvelistv5 – Published: 2026-11-03 22:55 – Updated: 2026-11-09 15:55
VLAI
EPSS
VEX
Title
blueprintUE Self-Hosted Edition before 4.3.4 Non-Expiring Account Confirmation Tokens
Summary
blueprintUE self-hosted edition before 4.3.4 contains an insufficient session expiration vulnerability that allows attackers to confirm accounts using stale tokens because UserModel::findUserIDWithConfirmedToken ignores confirmed_sent_at. Attackers who obtain an old confirmation link from a compromised mailbox, backup, or forwarded mail can activate unconfirmed accounts and evade the unconfirmed-account cleanup job.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 15:54 UTC
CWE
- CWE-613 - Insufficient Session Expiration
Assigner
VulnCheck
CNA
References
7 references
| URL | Tags |
|---|---|
| https://github.com/blueprintue/blueprintue-self-h… | patch |
| https://github.com/blueprintue/blueprintue-self-h… | product |
| https://github.com/blueprintue/blueprintue-self-h… | vendor-advisory |
| https://github.com/blueprintue/blueprintue-self-h… | patchissue-tracking |
| https://github.com/blueprintue/blueprintue-self-h… | technical-description |
| https://github.com/blueprintue/blueprintue-self-h… | release-notes |
| https://www.vulncheck.com/advisories/blueprintue-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| blueprintue | blueprintue-self-hosted-edition |
Affected:
0 , < 4.3.4
(semver)
|
Date Public
2026-11-02 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121735",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T15:54:07.910486Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T15:55:50.806Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/blueprintue/blueprintue-self-hosted-edition",
"product": "blueprintue-self-hosted-edition",
"vendor": "blueprintue",
"versions": [
{
"lessThan": "4.3.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Farhan Khan"
},
{
"lang": "en",
"type": "remediation developer",
"value": "rancoud"
}
],
"datePublic": "2026-11-02T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "blueprintUE self-hosted edition before 4.3.4 contains an insufficient session expiration vulnerability that allows attackers to confirm accounts using stale tokens because UserModel::findUserIDWithConfirmedToken ignores confirmed_sent_at. Attackers who obtain an old confirmation link from a compromised mailbox, backup, or forwarded mail can activate unconfirmed accounts and evade the unconfirmed-account cleanup job."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-613",
"description": "Insufficient Session Expiration",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T22:55:39.265Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/blueprintue/blueprintue-self-hosted-edition/commit/8bba1615bf76b144ac5cd72637c243490f08bc37"
},
{
"tags": [
"product"
],
"url": "https://github.com/blueprintue/blueprintue-self-hosted-edition"
},
{
"name": "GitHub Security Advisory (GHSA-qp6g-7v4v-33r9)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/blueprintue/blueprintue-self-hosted-edition/security/advisories/GHSA-qp6g-7v4v-33r9"
},
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/blueprintue/blueprintue-self-hosted-edition/pull/266"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/blueprintue/blueprintue-self-hosted-edition/blob/v4.3.3/app/models/UserModel.php#L361-L368"
},
{
"name": "blueprintUE v4.3.4 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/blueprintue/blueprintue-self-hosted-edition/releases/tag/v4.3.4"
},
{
"name": "VulnCheck Advisory: blueprintUE Self-Hosted Edition before 4.3.4 Non-Expiring Account Confirmation Tokens",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/blueprintue-self-hosted-edition-before-4.3.4-non-expiring-account-confirmation-tokens"
}
],
"title": "blueprintUE Self-Hosted Edition before 4.3.4 Non-Expiring Account Confirmation Tokens",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-121735",
"datePublished": "2026-11-03T22:55:39.265Z",
"dateReserved": "2026-11-03T22:17:05.690Z",
"dateUpdated": "2026-11-09T15:55:50.806Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120340 (GCVE-0-2026-120340)
Vulnerability from cvelistv5 – Published: 2026-11-02 04:00 – Updated: 2026-11-02 14:19
VLAI
EPSS
VEX
Title
mathurvishal CloudClassroom-PHP-Project Global Session session expiration
Summary
A weakness has been identified in mathurvishal CloudClassroom-PHP-Project. This issue affects some unknown processing of the component Global Session Handler. Executing a manipulation can lead to session expiration. The attack may be launched remotely. A high complexity level is associated with this attack. The exploitability is assessed as difficult. The exploit has been made available to the public and could be used for attacks. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 14:19 UTC
CWE
- CWE-613 - Session Expiration
Assigner
VulDB
CNA
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/429665 | vdb-entry |
| https://vuldb.com/vuln/429665/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-120340 | third-party-advisory |
| https://vuldb.com/submit/1016327 | third-party-advisory |
| https://github.com/vinniboy021-blip/Advisory/blob… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| mathurvishal | CloudClassroom-PHP-Project |
Affected:
5dadec098bfbbf3300d60c3494db3fb95b66e7be
Affected: c46ce5736007d9d6e51a8feeb9250729fe85f139 Affected: dae0c5961a35a4faf28cde9e02117538f09f81c1 cpe:2.3:a:mathurvishal:cloudclassroom-php-project:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120340",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T14:19:03.441803Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T14:19:13.457Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:mathurvishal:cloudclassroom-php-project:*:*:*:*:*:*:*:*"
],
"modules": [
"Global Session Handler"
],
"product": "CloudClassroom-PHP-Project",
"vendor": "mathurvishal",
"versions": [
{
"status": "affected",
"version": "5dadec098bfbbf3300d60c3494db3fb95b66e7be"
},
{
"status": "affected",
"version": "c46ce5736007d9d6e51a8feeb9250729fe85f139"
},
{
"status": "affected",
"version": "dae0c5961a35a4faf28cde9e02117538f09f81c1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "vinniboy021 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in mathurvishal CloudClassroom-PHP-Project. This issue affects some unknown processing of the component Global Session Handler. Executing a manipulation can lead to session expiration. The attack may be launched remotely. A high complexity level is associated with this attack. The exploitability is assessed as difficult. The exploit has been made available to the public and could be used for attacks. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 2.6,
"vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-613",
"description": "Session Expiration",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T04:00:20.951Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-429665 | mathurvishal CloudClassroom-PHP-Project Global Session session expiration",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/429665"
},
{
"name": "VDB-429665 | CTI Indicators (IOB, IOC)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/429665/cti"
},
{
"name": "CVE-2026-120340 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-120340"
},
{
"name": "Submit #1016327 | https://github.com/mathurvishal/CloudClassroom-PHP-Project CloudClassroom-PHP-Project 5dadec098bfbbf3300d60c3494db3fb95b66e7be Sensitive Cookie with Improper SameSite Attribute",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1016327"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/vinniboy021-blip/Advisory/blob/main/session-cookie-logout.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-11-01T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-01T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-01T16:44:37.000Z",
"value": "VulDB entry last update"
}
],
"title": "mathurvishal CloudClassroom-PHP-Project Global Session session expiration",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-120340",
"datePublished": "2026-11-02T04:00:20.951Z",
"dateReserved": "2026-11-01T15:39:14.531Z",
"dateUpdated": "2026-11-02T14:19:13.457Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119577 (GCVE-0-2026-119577)
Vulnerability from cvelistv5 – Published: 2026-10-30 13:18 – Updated: 2026-10-30 15:53
VLAI
EPSS
VEX
Title
ArcadeDB before 26.10.2 Improper Session Revocation in Wire-Protocol Connections
Summary
ArcadeDB before 26.10.2 contains an improper authorization vulnerability that allows revoked users to retain access through already-open Postgres, Bolt, MongoDB, or Redis wire-protocol connections. Attackers holding an existing connection can keep reading and writing data after deletion, grant removal, or password rotation, because executors keep a stale ServerSecurityUser.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 15:34 UTC
CWE
- CWE-613 - Insufficient Session Expiration
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/ArcadeData/arcadedb/security/a… | vendor-advisory |
| https://www.vulncheck.com/advisories/arcadedb-bef… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ArcadeData | arcadedb |
Affected:
0 , < 26.10.2
(semver)
Unaffected: 26.10.2 (semver) |
Date Public
2026-10-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119577",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T15:34:54.354034Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T15:53:42.078Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:maven/com.arcadedb/arcadedb-server",
"product": "arcadedb",
"vendor": "ArcadeData",
"versions": [
{
"lessThan": "26.10.2",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "26.10.2",
"versionType": "semver"
}
]
}
],
"datePublic": "2026-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "ArcadeDB before 26.10.2 contains an improper authorization vulnerability that allows revoked users to retain access through already-open Postgres, Bolt, MongoDB, or Redis wire-protocol connections. Attackers holding an existing connection can keep reading and writing data after deletion, grant removal, or password rotation, because executors keep a stale ServerSecurityUser."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-613",
"description": "Insufficient Session Expiration",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T13:18:15.066Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-vc4x-rm58-r9cr)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-vc4x-rm58-r9cr"
},
{
"name": "VulnCheck Advisory: ArcadeDB before 26.10.2 Improper Session Revocation in Wire-Protocol Connections",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/arcadedb-before-26.10.2-improper-session-revocation-in-wire-protocol-connections"
}
],
"title": "ArcadeDB before 26.10.2 Improper Session Revocation in Wire-Protocol Connections",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119577",
"datePublished": "2026-10-30T13:18:15.066Z",
"dateReserved": "2026-10-30T10:56:15.489Z",
"dateUpdated": "2026-10-30T15:53:42.078Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Implementation
Set sessions/credentials expiration date.
No CAPEC attack patterns related to this CWE.