CVE-2026-81826
2026-08-27
17h21 +00:00
17h21 +00:00
특정 CVE 알림
특정 CVE의 변경 사항에 대한 정보를 받아보세요.
CVE 설명
Affected versions of Flowintel do not revoke existing authenticated sessions when a user’s password is changed.
This means that if an attacker already possesses a valid session—for example, from prior access or a stolen session token—the victim changing their password does not terminate that attacker’s access. The session remains usable until it expires naturally. The upstream commit describes this directly as:
“session keeps working until it expires.”
The fix detects password changes and explicitly invokes _invalidate_user_sessions(user.id) after the database update. This is applied in both edit_user_core() and admin_edit_user_core().
Version impacted >=3.3.0
CVE 정보
관련 약점
| 약점 이름 | 출처 | |
|---|---|---|
| Session Fixation Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions. |
||
| DEPRECATED: Insufficient Session Expiration This entry has been deprecated because it was insufficiently clear. Consider CWE-1462 and its descendants. |
