49 matches found
CVE-2026-57493 FileRise: Remember-me auto-login uses stale admin role from token instead of current role
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise stores the isAdmin flag in remember-me tokens and restores that stale value during automatic login instead of resolving the account's current role from users.txt. A us...
CVE-2026-63160
Omnispace Agora Project before 26.10.0 contains a vulnerability where the persistent remember-me token is stored verbatim server-side, making the stored value identical to the bearer credential held in the user's cookie. Attackers who gain access to the stored token, such as through database or...
CVE-2026-63160 Omnispace Agora Project < 26.10.0 Insecure Remember-Me Token Storage
Omnispace Agora Project before 26.10.0 contains a vulnerability where the persistent remember-me token is stored verbatim server-side, making the stored value identical to the bearer credential held in the user's cookie. Attackers who gain access to the stored token, such as through database or...
CVE-2026-63160
The Omnispace Agora Project versions prior to 26.10.0 are vulnerable to insecure storage of persistent remember-me tokens . The software stores these tokens verbatim on the server-side, meaning the stored value is identical to the bearer credential held in the user's cookie. An attacker who gains...
CVE-2026-63160 Omnispace Agora Project < 26.10.0 Insecure Remember-Me Token Storage
Omnispace Agora Project before 26.10.0 contains a vulnerability where the persistent remember-me token is stored verbatim server-side, making the stored value identical to the bearer credential held in the user's cookie. Attackers who gain access to the stored token, such as through database or...
CVE-2026-63160
Omnispace Agora Project before 26.10.0 contains a vulnerability where the persistent remember-me token is stored verbatim server-side, making the stored value identical to the bearer credential held in the user's cookie. Attackers who gain access to the stored token, such as through database or...
EUVD-2026-100566
Omnispace Agora Project before 26.10.0 contains a vulnerability where the persistent remember-me token is stored verbatim server-side, making the stored value identical to the bearer credential held in the user's cookie. Attackers who gain access to the stored token, such as through database or...
CVE-2026-63160 Omnispace Agora Project < 26.10.0 Insecure Remember-Me Token Storage
Omnispace Agora Project before 26.10.0 contains a vulnerability where the persistent remember-me token is stored verbatim server-side, making the stored value identical to the bearer credential held in the user's cookie. Attackers who gain access to the stored token, such as through database or...
PT-2026-113336
Omnispace Agora Project before 26.10.0 contains a vulnerability where the persistent remember-me token is stored verbatim server-side, making the stored value identical to the bearer credential held in the user's cookie. Attackers who gain access to the stored token, such as through database or...
CVE-2026-63160: Insufficiently Protected Credentials
Omnispace Agora Project before 26.10.0 contains a vulnerability where the persistent remember-me token is stored verbatim server-side, making the stored value identical to the bearer credential held in the user's cookie. Attackers who gain access to the stored token, such as through database or...
CVE-2026-56750
A flaw was found in Gitea. An attacker who steals a user's "Remember Me" token can maintain unauthorized access to the user's account. This occurs because the system fails to invalidate the attacker's session even after the legitimate user logs out or changes their password. This vulnerability ca...
CVE-2026-76207
phpMyFAQ before 4.1.7 contains a two-factor authentication bypass vulnerability where remember-me tokens are issued before 2FA verification completes. Attackers with valid credentials can obtain a remember-me cookie, skip the 2FA challenge, and replay the cookie to gain full authenticated access...
EUVD-2026-62448
phpMyFAQ before 4.1.7 contains a two-factor authentication bypass vulnerability where remember-me tokens are issued before 2FA verification completes. Attackers with valid credentials can obtain a remember-me cookie, skip the 2FA challenge, and replay the cookie to gain full authenticated access...
CVE-2026-76207
phpMyFAQ before 4.1.7 issues remember-me cookies before 2FA verification, allowing attackers with valid credentials to skip the 2FA challenge and replay the cookie for full authenticated access. CVSS 8.1 HIGH. No in-the-wild exploitation reported. Upgrade to 4.1.7; advisory at https://github.com/...
CVE-2026-56750
Gitea Remember-Me Token Theft Not Invalidating Attacker Session...
CVE-2026-56750 Gitea Remember-Me Token Theft Not Invalidating Attacker Session
Gitea Remember-Me Token Theft Not Invalidating Attacker Session...
EUVD-2026-58145
Gitea Remember-Me Token Theft Not Invalidating Attacker Session...
CVE-2026-56750 Gitea Remember-Me Token Theft Not Invalidating Attacker Session
Gitea Remember-Me Token Theft Not Invalidating Attacker Session...
CVE-2026-56750
The Gitea Git service is affected by a vulnerability where Remember-Me tokens can be stolen without invalidating the attacker's session. This flaw relates to improper access control and session management. The vulnerability was addressed in Gitea version 1.27.0 . Remediation is available via the ...