Medium severity · published Oct 27, 2026
CVE-2026-116894
REDAXO before 5.21.5 Insufficient Session Expiration on Password Change
New
4.2
CVSS
–
EPSS
No
On KEV
Description
REDAXO before 5.21.5 contains an insufficient session expiration vulnerability that allows attackers to retain account access by keeping the current session and stay-logged-in key valid after a password change. Attackers who obtained a user's session id or stay-logged-in cookie can keep backend access after the password change, via the cookie for up to three months.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
core · redaxo
before 5.21.5 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-116894
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-116894
github.com
https://github.com/redaxo/core/commit/672d22a779bfce7aa4aa445d9c831a824fb86896
github.com
https://github.com/redaxo/core/security/advisories/GHSA-mjjv-vffq-g5h6
www.vulncheck.com
https://www.vulncheck.com/advisories/redaxo-before-5.21.5-insufficient-session-expiration-on-password-change
More from core
9.8
CVE-2026-117532
REDAXO Core 5.3.0 before 5.21.4 Authentication Bypass via History Plugin
8.8
CVE-2026-117536
REDAXO before 5.21.3 CSRF Token Bypass via users/users Privilege Escalation
7.5
CVE-2026-116896
REDAXO before 5.21.5 Privilege Escalation via Backup Export of Authentication Tables
7.5
CVE-2026-53599
Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extension handlers
7.1
CVE-2026-116898
REDAXO before 5.21.4 Missing Authorization in Media Pool Bulk Move