CVE-2026-86589mediumCWE-303

CVE-2026-86589: fallo de gravedad media en Apache Answer

Apache Answer: User Center integration does not revoke first-login sessions after central account suspension

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Apache Answer

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.4epss 0.3%
Incorrect implementation of authentication algorithm vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. A flaw in the User Center login integration can cause a newly created external user session to omit its external identity, allowing subsequent requests to bypass central account suspension or deletion checks until the session expires or is revoked. Users are recommended to upgrade to version 2.0.3, which fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Productos afectados
Apache Software Foundation · Apache Answer
CVEs relacionadas — Apache Answer

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-22393CRITICALApache Answer: Pixel Flood Attack by uploading the large pixel fileEPSS 2.5%CVE-2024-41888MEDIUMApache Answer: The link for resetting user password is not Single-UseEPSS 1.2%CVE-2024-41890MEDIUMApache Answer: The link to reset the user's password will remain valid after sending a new linkEPSS 1.1%CVE-2024-23349MEDIUMApache Answer: XSS vulnerability when submitting summaryEPSS 1.1%CVE-2025-29868MEDIUMApache Answer: Using externally referenced images can leak user privacy.EPSS 1.0%CVE-2024-29217MEDIUMApache Answer: XSS vulnerability when changing personal websiteEPSS 1.0%