CVE-2026-120997

Improper Session Invalidation vulnerability in the dashboard pages, device console and local shell channels in nerves-hub nerveshubweb allows an organization member who is removed or given a lower role to keep acting at their old role through anything they had open at the time. The dashboard read...

CVE-2026-120997 Improper session invalidation keeps removed or demoted members' open pages and device consoles working at their old role

Improper Session Invalidation vulnerability in the dashboard pages, device console and local shell channels in nerves-hub nerveshubweb allows an organization member who is removed or given a lower role to keep acting at their old role through anything they had open at the time. The dashboard read...

CVE-2026-120997 Improper session invalidation keeps removed or demoted members' open pages and device consoles working at their old role

Improper Session Invalidation vulnerability in the dashboard pages, device console and local shell channels in nerves-hub nerveshubweb allows an organization member who is removed or given a lower role to keep acting at their old role through anything they had open at the time. The dashboard read...

CVE-2026-120997

Improper Session Invalidation vulnerability in the dashboard pages, device console and local shell channels in nerves-hub nerveshubweb allows an organization member who is removed or given a lower role to keep acting at their old role through anything they had open at the time. The dashboard read...

CVE-2026-120997

The nerves_hub nerves_hub_web component (versions 1.0.0 before 2.5.3 ) is vulnerable to Improper Session Invalidation (CWE-1464, CWE-1465). The dashboard, device console, and local shell channels only verify user roles once at page mount or socket join. Consequently, a removed or demoted member c...

Session-Persistence-After-Enabling-2FA-CVE-2025-60425

Session Persistence After Enabling 2FA Overview The Nagios Fusion application version 2024R1.2 and 2024R2 contains a high security flaw where existing sessions remain valid even after enabling Two-Factor Authentication 2FA. Specifically, when 2FA is enabled for an administrator account, the...

CVE-2026-110826

Improper Session Invalidation after Authentication Credential Change vulnerability in team-alembic ashauthentication allows an attacker holding a victim's session token to stay signed in after the victim resets or changes their password. With applyonpasswordchange? true,...

CVE-2026-110826 AshAuthentication log_out_everywhere leaves sessions valid after a password reset or non-atomic password change

Improper Session Invalidation after Authentication Credential Change vulnerability in team-alembic ashauthentication allows an attacker holding a victim's session token to stay signed in after the victim resets or changes their password. With applyonpasswordchange? true,...

EUVD-2026-116148

Improper Session Invalidation after Authentication Credential Change vulnerability in team-alembic ashauthentication allows an attacker holding a victim's session token to stay signed in after the victim resets or changes their password. With applyonpasswordchange? true,...

EEF-CVE-2026-110826 AshAuthentication log_out_everywhere leaves sessions valid after a password reset or non-atomic password change

Summary Improper Session Invalidation after Authentication Credential Change vulnerability in team-alembic ashauthentication allows an attacker holding a victim's session token to stay signed in after the victim resets or changes their password. With applyonpasswordchange? true,...

CVE-2026-79624

Apache Answer versions through 2.0.2 are vulnerable to an insufficient session expiration issue. The root cause is improper session invalidation, which allows revoked users to maintain access to private uploaded files using a stale visit token. To mitigate this risk, users are recommended to upgr...

CVE-2026-79624 Apache Answer: Stale Visit Tokens Retain Access to Private Uploads After Session Revocation

Insufficient session expiration vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Insufficient session invalidation allowed revoked users to continue accessing known private uploaded files with a stale visit token. Users are recommended to upgrade to version 2.0.3,...

Astra Linux – vulnerability in jetty9

In Eclipse Jetty versions = 9.4.40, = 10.0.2, and = 11.0.2, if an exception is thrown from the SessionListenersessionDestroyed method, the session ID is not invalidated in the session ID manager. In deployments featuring clustered sessions and multiple contexts, this can prevent the session ID fr...

CVE-2026-74037 Wazuh 4.0.0 before 4.14.8 Session Invalidation Bypass in check_token

Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for runas users with zero static roles, because checktoken never consults the blacklist. Attackers with revoked administrator grants can continue authenticating and self-link the administrator role to permanently retain privileged access...

CVE-2026-74037 Wazuh 4.0.0 before 4.14.8 Session Invalidation Bypass in check_token

Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for runas users with zero static roles, because checktoken never consults the blacklist. Attackers with revoked administrator grants can continue authenticating and self-link the administrator role to permanently retain privileged access...

CVE-2026-74037 Wazuh 4.0.0 before 4.14.8 Session Invalidation Bypass in check_token

Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for runas users with zero static roles, because checktoken never consults the blacklist. Attackers with revoked administrator grants can continue authenticating and self-link the administrator role to permanently retain privileged access...

CVE-2026-74037

Wazuh versions 4.0.0 before 4.14.8 are vulnerable to a Session Invalidation Bypass in the check_token function. The root cause is that the system fails to consult the blacklist when validating issued tokens for run_as users with zero static roles. This allows an attacker with revoked administrato...

BIT-GHOST-2026-103279 Ghost 3.10.0 before 6.34.0 Session Invalidation Bypass

Ghost versions from 3.10.0 before 6.34.0 fail to fully invalidate all sessions after a password change. Attackers with a stolen session cookie can maintain access to user accounts even after the associated user changes their password...

CVE-2026-103279 Ghost 3.10.0 before 6.34.0 Session Invalidation Bypass

Ghost versions from 3.10.0 before 6.34.0 fail to fully invalidate all sessions after a password change. Attackers with a stolen session cookie can maintain access to user accounts even after the associated user changes their password...

CVE-2026-103279 Ghost 3.10.0 before 6.34.0 Session Invalidation Bypass

Ghost versions from 3.10.0 before 6.34.0 fail to fully invalidate all sessions after a password change. Attackers with a stolen session cookie can maintain access to user accounts even after the associated user changes their password...