CVE-2026-105690
Penpot: Server-side session not invalidated on logout; stale auth-token cookie remains valid for full profile access
CVSS Score
5.9
EPSS Score
0.0%
EPSS Percentile
0th
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, logout clears the browser's auth-token cookie without revoking the corresponding server-side session. A previously captured session token remains usable after the victim logs out and can continue to make authenticated requests with the victim's authority until natural expiration. This issue is fixed in version 2.18.0.
| CWE | CWE-613 |
| Vendor | penpot |
| Product | penpot |
| Published | Oct 5, 2026 |
| Last Updated | Oct 5, 2026 |
Stay Ahead of the Next One
Get instant alerts for penpot penpot
Be the first to know when new medium vulnerabilities affecting penpot penpot are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
None
Affected Versions
penpot / penpot
< 2.18.0