CVE-2026-59074
Improper Cryptographic Signature Verification in Edito CMS
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Edito CMS is vulnerable to improper cryptographic signature verification in the JWT refresh logic. An authenticated low-privilege user can submit self-crafted JWT containing an existing user identifier and, due to the lack of signature validation, obtain a valid, fully-signed session token for any account in the system. This allows the attacker to impersonate any user, including administrators. This issue was fixed in version 5.10.2607. Hotfixes for older versions (5.8) have also been released.
| CWE | CWE-347 |
| Vendor | edito |
| Product | edito cms |
| Published | Nov 13, 2026 |
Stay Ahead of the Next One
Get instant alerts for edito edito cms
Be the first to know when new unknown vulnerabilities affecting edito edito cms are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Edito / Edito CMS
0 < 5.10.2607
References
Credits
Michał Majchrowicz (AFINE Team) Dawid Małecki (AFINE Team) Paweł Zdunek (AFINE Team)