Vulnerability · Published Sep 17, 2026 · Assigned by VulnCheck
CVE-2026-92918admin3 through 3.0.0 Session Token Disclosure via Audit Log
High 8.8
In plain English
A high-severity sensitive data in logs in admin3 from cjbi. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.6%top 48.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
admin3 through 3.0.0 persists user session tokens in the audit log event body when publishing UserLoggedIn domain events. Attackers with log:view permission can read the JSON response from the GET /logs endpoint to harvest session tokens and replay them as bearer credentials for full user access.
Affected products (as reported)
Weakness: CWE-532 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- admin3 - session token disclosure through the audit log (PoC) exploit
- LogService.java at 3.0.0 technical-description
- DefaultSessionService.java at 3.0.0 technical-description
- data.sql at 3.0.0 (seeded role permissions) technical-description
- Product product
- VulnCheck Advisory: admin3 through 3.0.0 Session Token Disclosure via Audit Log third-party-advisory