CVE-2026-59080
JWT Exposure via GET Request in Edito CMS
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Edito CMS sends JWT token via GET requests. This allows a local attacker with access to browser history to obtain valid JWT token and perform action on behalf of the victim. The token is valid for only short period of time; after that time, it expires and can no longer be used. The vendor assessed the likelihood of exploitation as very low and determined that a fix is not necessary.
| CWE | CWE-598 |
| Vendor | edito |
| Product | edito cms |
| Published | Nov 13, 2026 |
Stay Ahead of the Next One
Get instant alerts for edito edito cms
Be the first to know when new unknown vulnerabilities affecting edito edito cms are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Edito / Edito CMS
0 ≤ 5.10.2607
References
Credits
Michał Majchrowicz (AFINE Team) Dawid Małecki (AFINE Team) Paweł Zdunek (AFINE Team)