CVE-2026-78357 Insufficient Session Revocation for JWT Authentication

Previously issued authentication tokens are not immediately invalidated when an OTRS agent or customer user account is deactivated or its password is changed. As a result, an existing JWT may remain valid until its regular expiration time, which can be approximately 16 hours. An attacker who has...

CVE-2026-78357

The OTRS helpdesk software versions 7.0.X , 8.0.X , 2023.X , 2024.X , 2025.X , and 2026.X before 2026.7.X are vulnerable to insufficient session revocation for JWT authentication . The root cause is that authentication tokens are not immediately invalidated when a user account is deactivated or a...

GHSA-4HV6-XC92-J86G Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes

Summary Vikunja v2.6.0 introduced server-side sessions with revocation semantics: DELETE /api/v2/user/sessions/id documents "Revokes a specific session by its UUID", and enabling TOTP calls DeleteAllUserSessions to invalidate all sessions. The WebSocket endpoint accepts any cryptographically vali...

AfterLife

AFTERLIFE Revocation Persistence Detection Lab When the password reset succeeds but the attacker never leaves. A local red/blue lab for one vulnerability class: the credential that outlives the event that was supposed to kill it. It ships the exploit, the root cause, the fix, a three-rule detecti...

GO-2026-6482 Mattermost doesn't invalidate cached authentication state for active WebSocket connections during global session revocation in github.com/mattermost/mattermost-server

Mattermost doesn't invalidate cached authentication state for active WebSocket connections during global session revocation in github.com/mattermost/mattermost-server...

CVE-2026-86533: Insufficient Session Expiration

Insufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully authenticated. A resource configured with sessionidentifier :jti and requiretokenpresenceforauthentication? disabled stores its session value as :...

CVE-2026-82311 Apache Airflow FAB provider: FAB password reset never invalidates sessions: string/int _user_id comparison is always false

Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour that it does. The cleanup compares the string identifier Flask-Login stores in the session against the user's integer database identifier, so the...

EUVD-2026-67132

Affected versions of Flowintel do not revoke existing authenticated sessions when a user’s password is changed. This means that if an attacker already possesses a valid session—for example, from prior access or a stolen session token—the victim changing their password does not terminate that...

CVE-2026-45791 Dokploy: Password Change Does Not Revoke Active Sessions

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.6, Dokploy's user.update procedure in apps/dokploy/server/api/routers/user.ts updates account.password without deleting other rows from session, allowing a compromised better-auth.sessiontoken session to remain valid for u...

EUVD-2026-54150

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, when a user navigates to the /logout page, the page's server-side load handler deletes the accesstoken cookie before calling /api/auth/logout via an internal...

CVE-2026-48079

OpenReception’s OpenReception appointment-booking software before v1.0.2 suffers a logout-order flaw: the logout page deletes the access_token cookie before invoking the server-side logout. As a result, internal fetches for /api/auth/logout run without the auth cookie, so apiAuthHandle rejects th...

CVE-2026-48079 OpenReception's logout page clears local access_token before server-side revocation, leaving duplicated tokens valid until expiry

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, when a user navigates to the /logout page, the page's server-side load handler deletes the accesstoken cookie before calling /api/auth/logout via an internal...

PT-2026-68741

Name of the Vulnerable Software and Affected Versions OpenReception versions prior to 1.0.2 Description An ordering error in the server-side load handler of the /logout page causes the access token cookie to be deleted before the /api/auth/logout endpoint is called via event.fetch. Because the...

CVE-2026-39924

Flarum before 1.8.16 contains an improper session invalidation vulnerability that allows attackers who hold a valid session token to retain full account access after a victim changes their password, because the accesstokens table is never cleared on password change events. The...

CVE-2026-55735

Improper Verification of Cryptographic Signature in ueberauth guardian allows an unauthenticated attacker to revoke a victim's session with a forged token. Guardian.revoke/3 in lib/guardian.ex decodes the supplied token with peek/1, which performs no signature verification it only base64-decodes...

CVE-2026-55735

Improper Verification of Cryptographic Signature in ueberauth guardian allows an unauthenticated attacker to revoke a victim's session with a forged token. Guardian.revoke/3 in lib/guardian.ex decodes the supplied token with peek/1, which performs no signature verification it only base64-decodes...

CVE-2026-55735 Guardian.revoke/3 acts on unverified token claims, allowing forged-token session revocation

Improper Verification of Cryptographic Signature in ueberauth guardian allows an unauthenticated attacker to revoke a victim's session with a forged token. Guardian.revoke/3 in lib/guardian.ex decodes the supplied token with peek/1, which performs no signature verification it only base64-decodes...

CVE-2026-55735 Guardian.revoke/3 acts on unverified token claims, allowing forged-token session revocation

Improper Verification of Cryptographic Signature in ueberauth guardian allows an unauthenticated attacker to revoke a victim's session with a forged token. Guardian.revoke/3 in lib/guardian.ex decodes the supplied token with peek/1, which performs no signature verification it only base64-decodes...

CVE-2026-55735 Guardian.revoke/3 acts on unverified token claims, allowing forged-token session revocation

Improper Verification of Cryptographic Signature in ueberauth guardian allows an unauthenticated attacker to revoke a victim's session with a forged token. Guardian.revoke/3 in lib/guardian.ex decodes the supplied token with peek/1, which performs no signature verification it only base64-decodes...

CVE-2026-55735

CVE-2026-55735 affects guardian: from 1.0.0 up to before 2.4.1. The revoke/3 path in Guardian.revoke/3 decodes tokens with peek/1 without signature verification, unlike refresh/2 and exchange/4 which verify. An attacker who knows a victim’s jti/sub can forge a JWT and submit it to an endpoint tha...