CVE-2026-34828: high-severity vulnerability in knadh listmonk
listmonk: Active sessions remain valid after password reset and password change
Published · Updated
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.1epss 0.4%
exploitation probability
0.4%top 71% of all CVEs
observed exploitation
nono source reports it
listmonk is a standalone, self-hosted, newsletter and mailing list manager. From version 4.1.0 to before version 6.1.0, a session management vulnerability allows previously issued authenticated sessions to remain valid after sensitive account security changes, specifically password reset and password change. As a result, an attacker who has already obtained a valid session cookie can retain access to the account even after the victim changes or resets their password. This weakens account recovery and session security guarantees. This issue has been patched in version 6.1.0.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Affected products
knadh · listmonkRelated CVEs — knadh listmonk
In the same product, most dangerous first.
CVE-2025-49136CRITICALlistmonk's Sprig template Injection vulnerability leads to reading of Environment Variable for low privilege userEPSS 1.5%CVE-2026-62361MEDIUMlistmonk: SQL Injection in `/api/subscribers/export` bypasses table access control, leaking admin password hashes and SMTP credentialsEPSS 0.4%CVE-2026-34584MEDIUMlistmonk: Broken Access Control in CSV Import (Unauthorized List Assignment)EPSS 0.3%CVE-2026-21483MEDIUMlistmonk Vulnerable to Stored XSS Leading to Admin Account TakeoverEPSS 0.2%CVE-2025-58430HIGHlistmonk Vulnerable to CSRF to XSS Chain That Can Lead to Admin Account TakeoverEPSS 0.1%