CVE-2026-116894

MEDIUM 4.2

REDAXO before 5.21.5 Insufficient Session Expiration on Password Change

CVSS Score

4.2

EPSS Score

0.0%

EPSS Percentile

0th

REDAXO before 5.21.5 contains an insufficient session expiration vulnerability that allows attackers to retain account access by keeping the current session and stay-logged-in key valid after a password change. Attackers who obtained a user's session id or stay-logged-in cookie can keep backend access after the password change, via the cookie for up to three months.

CWE	CWE-613
Vendor	redaxo
Product	core
Published	Oct 27, 2026

Stay Ahead of the Next One

Get instant alerts for redaxo core

Be the first to know when new medium vulnerabilities affecting redaxo core are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

redaxo / core

0 < 5.21.5

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/redaxo/core/security/advisories/GHSA-mjjv-vffq-g5h6 github.com: https://github.com/redaxo/core/commit/672d22a779bfce7aa4aa445d9c831a824fb86896 vulncheck.com: https://www.vulncheck.com/advisories/redaxo-before-5.21.5-insufficient-session-expiration-on-password-change

Credits

AlpetGexha