Medium severity · published Oct 5, 2026
CVE-2026-105690
Penpot: Server-side session not invalidated on logout; stale auth-token cookie remains valid for full profile access
5.9
CVSS
0.2%
EPSS
No
On KEV
Description
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, logout clears the browser's auth-token cookie without revoking the corresponding server-side session. A previously captured session token remains usable after the victim logs out and can continue to make authenticated requests with the victim's authority until natural expiration. This issue is fixed in version 2.18.0.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 12% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PE
penpot · penpot
< 2.18.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-105690
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-105690
x_refsource_CONFIRM
https://github.com/penpot/penpot/security/advisories/GHSA-mj9f-5cwq-7p3q
x_refsource_MISC
https://github.com/penpot/penpot/commit/7c85837290c4e7d6f7d99472b092ad4f7c9d6a97
x_refsource_MISC
https://github.com/penpot/penpot/releases/tag/2.18.0
More from penpot
9.9
CVE-2026-105691
Penpot: Authenticated OS Command Injection in Penpot SVG Exporter via Legacy fill-color
9.9
CVE-2026-44986
Penpot: Pre-authenticated account takeover via team-invitation token + prepare-register-profile
8.8
CVE-2026-45805
Penpot: MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCE
8.7
CVE-2026-47665
Penpot: Stored XSS via comment content, innerHTML renders unsanitized HTML
7.7
CVE-2026-45806
Penpot: Authenticated SSRF in remote image import via create-file-media-object-from-url