CVE-2026-50000

SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communicate with anonymous sources. From 2.5.0 until 2.16.0, the Journalist Interface can accept an API session token against the web UI because its SessionInterfac...

CVE-2026-50000 SecureDrop: API session token reuse against the Journalist Interface web UI

SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communicate with anonymous sources. From 2.5.0 until 2.16.0, the Journalist Interface can accept an API session token against the web UI because its SessionInterfac...

CVE-2026-50000 SecureDrop: API session token reuse against the Journalist Interface web UI

SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communicate with anonymous sources. From 2.5.0 until 2.16.0, the Journalist Interface can accept an API session token against the web UI because its SessionInterfac...

CVE-2026-50000

The SecureDrop whistleblower submission system (versions 2.5.0 through 2.16.0 ) is vulnerable to session token reuse. The SessionInterface maintains a mutable session key prefix that persists across requests, causing prefix corruption that confuses Redis session namespaces. This allows an attacke...

EUVD-2026-114255

SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communicate with anonymous sources. From 2.5.0 until 2.16.0, the Journalist Interface can accept an API session token against the web UI because its SessionInterfac...