Session-Persistence-After-Enabling-2FA-CVE-2025-60425

Session Persistence After Enabling 2FA Overview The Nagios Fusion application version 2024R1.2 and 2024R2 contains a high security flaw where existing sessions remain valid even after enabling Two-Factor Authentication 2FA. Specifically, when 2FA is enabled for an administrator account, the...

CVE-2026-74037

Wazuh versions 4.0.0 before 4.14.8 are vulnerable to a Session Invalidation Bypass in the check_token function. The root cause is that the system fails to consult the blacklist when validating issued tokens for run_as users with zero static roles. This allows an attacker with revoked administrato...

CVE-2026-103279

Ghost versions 3.10.0 before 6.34.0 are vulnerable to a session invalidation bypass . The application fails to fully invalidate all active sessions following a password change. This allows an attacker who has obtained a stolen session cookie to maintain unauthorized access to a user account even ...

CVE-2026-103279 Ghost 3.10.0 before 6.34.0 Session Invalidation Bypass

Ghost versions from 3.10.0 before 6.34.0 fail to fully invalidate all sessions after a password change. Attackers with a stolen session cookie can maintain access to user accounts even after the associated user changes their password...

EUVD-2026-90672

Ghost versions from 3.10.0 before 6.34.0 fail to fully invalidate all sessions after a password change. Attackers with a stolen session cookie can maintain access to user accounts even after the associated user changes their password...

CVE-2026-103279 Ghost 3.10.0 before 6.34.0 Session Invalidation Bypass

Ghost versions from 3.10.0 before 6.34.0 fail to fully invalidate all sessions after a password change. Attackers with a stolen session cookie can maintain access to user accounts even after the associated user changes their password...

CVE-2026-103279 Ghost 3.10.0 before 6.34.0 Session Invalidation Bypass

Ghost versions from 3.10.0 before 6.34.0 fail to fully invalidate all sessions after a password change. Attackers with a stolen session cookie can maintain access to user accounts even after the associated user changes their password...

CVE-2026-79317

A session invalidation flaw exists in x-ui 0.3.2. The full user object is stored in a client-side signed cookie, and authentication only checks that a user object can be retrieved from the cookie without re-validating against the database or any session version. When an administrator changes the...

CVE-2026-79317

A session invalidation flaw exists in x-ui 0.3.2. The full user object is stored in a client-side signed cookie, and authentication only checks that a user object can be retrieved from the cookie without re-validating against the database or any session version. When an administrator changes the...

EUVD-2026-84149

A session invalidation flaw exists in x-ui 0.3.2. The full user object is stored in a client-side signed cookie, and authentication only checks that a user object can be retrieved from the cookie without re-validating against the database or any session version. When an administrator changes the...

PT-2026-96241

Name of the Vulnerable Software and Affected Versions x-ui version 0.3.2 Description A session invalidation flaw occurs because the full user object is stored in a client-side signed cookie. The authentication process only verifies that a user object can be retrieved from the cookie, failing to...

CVE-2026-79317

A session invalidation flaw exists in x-ui 0.3.2. The full user object is stored in a client-side signed cookie, and authentication only checks that a user object can be retrieved from the cookie without re-validating against the database or any session version. When an administrator changes the...

CVE-2026-79317: Insufficient Session Expiration

A session invalidation flaw exists in x-ui 0.3.2. The full user object is stored in a client-side signed cookie, and authentication only checks that a user object can be retrieved from the cookie without re-validating against the database or any session version. When an administrator changes the...

CVE-2026-79317

A session invalidation flaw exists in x-ui 0.3.2 because the full user object is stored in a client-side signed cookie . The application's authentication mechanism only verifies that a user object can be retrieved from the cookie without re-validating against the database or checking a session ve...

CVE-2026-92920

admin3 through 3.0.0 fails to invalidate existing sessions when disabling a user account, allowing attackers to retain authenticated access with original permissions. Attackers can continue using bearer tokens issued before account disablement to authenticate requests, as the AuthInterceptor neve...

CVE-2026-92920

admin3 (a Java-based admin framework) through 3.0.0 fails to invalidate existing sessions when a user account is disabled. The root cause lies in the AuthInterceptor , which never re-validates a user's locked status, and the LocalSessionManager , which resets session expiry on each request. As a ...

CVE-2026-92920 admin3 through 3.0.0 Session Not Invalidated When a User Account Is Disabled

admin3 through 3.0.0 fails to invalidate existing sessions when disabling a user account, allowing attackers to retain authenticated access with original permissions. Attackers can continue using bearer tokens issued before account disablement to authenticate requests, as the AuthInterceptor neve...

CVE-2026-92920 admin3 through 3.0.0 Session Not Invalidated When a User Account Is Disabled

admin3 through 3.0.0 fails to invalidate existing sessions when disabling a user account, allowing attackers to retain authenticated access with original permissions. Attackers can continue using bearer tokens issued before account disablement to authenticate requests, as the AuthInterceptor neve...

EUVD-2026-81575

admin3 through 3.0.0 fails to invalidate existing sessions when disabling a user account, allowing attackers to retain authenticated access with original permissions. Attackers can continue using bearer tokens issued before account disablement to authenticate requests, as the AuthInterceptor neve...

CVE-2026-86462

Apache Airflow FAB provider: changing a user's password through the Admin user-edit PATCH endpoint does not invalidate that user's existing database-backed sessions. An attacker who already holds a copy of the victim's session cookie keeps full access as that user after the password change, so th...