CVE-2026-25700: high-severity vulnerability in Apache Answer
Apache Answer: AdminToken not invalidated after admin deactivation
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
When an administrator account is deactivated or deleted in Apache Answer, their security tokens remain valid and can still be used to access admin functions. This means a former admin could keep using their old access credentials even after being removed.
Apache Answer fails to invalidate previously issued admin tokens when an administrator account is suspended, deleted, or deactivated (CWE-1259: Improper Restriction of Security Token Assignment). An attacker possessing a valid admin token from a deactivated account can continue accessing administrative APIs until natural token expiration, bypassing intended access revocation.
In the same product, most dangerous first.