Vulnerability · Published Feb 26, 2026 · Assigned by GitHub_M

CVE-2026-28275Initiative Vulnerable to Improper Session Invalidation (JWT Remains Valid)

High 8.1

In plain English

A high-severity security flaw in initiative from Morelitea. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.4%top 64.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Initiative is a self-hosted project management platform. Versions of the application prior to 0.32.4 do not invalidate previously issued JWT access tokens after a user changes their password. As a result, older tokens remain valid until expiration and can still be used to access protected API endpoints. This behavior allows continued authenticated access even after the account password has been updated. Version 0.32.4 fixes the issue.

Affected products (as reported)

Vendor	Product	Versions
Morelitea	initiative	< 0.32.4

Weakness: CWE-613 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References

https://github.com/Morelitea/initiative/security/advisories/GHSA-hww6-3fww-xw3h x_refsource_CONFIRM
https://github.com/Morelitea/initiative/releases/tag/v0.32.4 x_refsource_MISC