Vulnerability · Published Oct 27, 2026 · Assigned by VulnCheck
CVE-2026-116894REDAXO before 5.21.5 Insufficient Session Expiration on Password Change
Medium 4.2
In plain English
A medium-severity security flaw in core from redaxo. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).
Severity (CVSS 3.1)4.2Medium
Exploit odds (30 days)0.2%top 94.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
REDAXO before 5.21.5 contains an insufficient session expiration vulnerability that allows attackers to retain account access by keeping the current session and stay-logged-in key valid after a password change. Attackers who obtained a user's session id or stay-logged-in cookie can keep backend access after the password change, via the cookie for up to three months.
Affected products (as reported)
Weakness: CWE-613 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N