Vulnerability · Published Mar 4, 2026 · Assigned by 2N
CVE-2025-59786Cookies are not Invalidated upon Logout and Password Change
Medium 6.0
In plain English
A medium-severity security flaw in 2N Access Commander from 2N Telekomunikace a.s.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).
Severity (CVSS 4.0)6.0Medium
Exploit odds (30 days)0.3%top 78.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
2N Access Commander version 3.4.2 and prior improperly invalidates session tokens, allowing multiple session cookies to remain active after logout in web application.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| 2N Telekomunikace a.s. | 2N Access Commander | 0 – before 3.5 |
Weakness: CWE-613 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
References
- https://www.2n.com/en-GB/download/cve_2025_59786_acom_3_5_v1pdf vendor-advisory