https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 11:00:39 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-375132 EUVD-2026-375132 https://cve.radiocsirt.org/vuln/euvd-2026-375132 https://cve.radiocsirt.org/vuln/fkie_cve-2026-92920 <p>admin3 through 3.0.0 fails to invalidate existing sessions when disabling a user account, allowing attackers to retain authenticated access with original permissions. Attackers can continue using bearer tokens issued before account disablement to authenticate requests, as the AuthInterceptor never re-validates the user&#39;s locked status and session expiry resets on each request.</p> <p>admin3 through 3.0.0 fails to invalidate existing sessions when disabling a user account, allowing attackers to retain authenticated access with original permissions. Attackers can continue using bearer tokens issued before account disablement to authenticate requests, as the AuthInterceptor never re-validates the user&#39;s locked status and session expiry resets on each request.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-92920 https://cve.radiocsirt.org/vuln/ghsa-xx9v-9858-mwgg <p>admin3 through 3.0.0 fails to invalidate existing sessions when disabling a user account, allowing attackers to retain authenticated access with original permissions. Attackers can continue using bearer tokens issued before account disablement to authenticate requests, as the AuthInterceptor never re-validates the user&#39;s locked status and session expiry resets on each request.</p> <p>admin3 through 3.0.0 fails to invalidate existing sessions when disabling a user account, allowing attackers to retain authenticated access with original permissions. Attackers can continue using bearer tokens issued before account disablement to authenticate requests, as the AuthInterceptor never re-validates the user&#39;s locked status and session expiry resets on each request.</p> https://cve.radiocsirt.org/vuln/ghsa-xx9v-9858-mwgg