https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 19:55:03 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-280204 EUVD-2026-280204 https://cve.radiocsirt.org/vuln/euvd-2026-280204 https://cve.radiocsirt.org/vuln/fkie_cve-2026-34828 <p>listmonk is a standalone, self-hosted, newsletter and mailing list manager. From version 4.1.0 to before version 6.1.0, a session management vulnerability allows previously issued authenticated sessions to remain valid after sensitive account security changes, specifically password reset and password change. As a result, an attacker who has already obtained a valid session cookie can retain access to the account even after the victim changes or resets their password. This weakens account recovery and session security guarantees. This issue has been patched in version 6.1.0.</p> <p>listmonk is a standalone, self-hosted, newsletter and mailing list manager. From version 4.1.0 to before version 6.1.0, a session management vulnerability allows previously issued authenticated sessions to remain valid after sensitive account security changes, specifically password reset and password change. As a result, an attacker who has already obtained a valid session cookie can retain access to the account even after the victim changes or resets their password. This weakens account recovery and session security guarantees. This issue has been patched in version 6.1.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-34828 https://cve.radiocsirt.org/vuln/ghsa-h5j9-cvrw-v5qh <p><strong>Affected:</strong> Go: github.com/knadh/listmonk</p> <p>### Summary A session management vulnerability allows previously issued authenticated sessions to remain valid after sensitive account security changes, specifically password reset and password change. As a result, an attacker who has already obtained a valid session cookie can retain access to the account even after the victim changes or resets their password.</p> <p>This weakens account recovery and session security guarantees. I reproduced the issue on listmonk v6.0.0.</p> <p>### Details The application updates account credentials successfully, but existing active sessions are not revoked afterward.</p> <p>This behavior was confirmed in two flows:</p> <p>1. **Password reset flow** - A user resets their password through the forgot/reset flow. - The old password becomes invalid. - The new password works. - However, a session cookie issued **before** the reset remains valid and continues to authenticate successfully.</p> <p>2. **Authenticated password change flow** - The same user logs in from two separate sessions. - Using session A, the password is changed through the authenticated profile endpoint. - The old password becomes invalid. - The new password works. - However, session B, issued before the password change, remains valid and continues to authenticate successfully.</p> <p>From the source review, the reset flow consumes the reset token, updates the password, and creates a fresh session, but there does not appear to be any revocation of older sessions. The same applies to the…</p> <p><strong>Affected:</strong> Go: github.com/knadh/listmonk</p> <p>### Summary A session management vulnerability allows previously issued authenticated sessions to remain valid after sensitive account security changes, specifically password reset and password change. As a result, an attacker who has already obtained a valid session cookie can retain access to the account even after the victim changes or resets their password.</p> <p>This weakens account recovery and session security guarantees. I reproduced the issue on listmonk v6.0.0.</p> <p>### Details The application updates account credentials successfully, but existing active sessions are not revoked afterward.</p> <p>This behavior was confirmed in two flows:</p> <p>1. **Password reset flow** - A user resets their password through the forgot/reset flow. - The old password becomes invalid. - The new password works. - However, a session cookie issued **before** the reset remains valid and continues to authenticate successfully.</p> <p>2. **Authenticated password change flow** - The same user logs in from two separate sessions. - Using session A, the password is changed through the authenticated profile endpoint. - The old password becomes invalid. - The new password works. - However, session B, issued before the password change, remains valid and continues to authenticate successfully.</p> <p>From the source review, the reset flow consumes the reset token, updates the password, and creates a fresh session, but there does not appear to be any revocation of older sessions. The same applies to the…</p> https://cve.radiocsirt.org/vuln/ghsa-h5j9-cvrw-v5qh