Insufficient session expiration in Apache Answer (CVE-2026-60053)

Apache Answer fails to invalidate administrative API keys when the owning account is demoted, deactivated, suspended, or deleted. The keys remain fully operational until explicitly removed, allowing unauthorized continued access to administrative API functionality by former or revoked administrators. Affected versions: - Apache Answer through 2.0.1 We recommend updating to: 2.0.2. CVSS 9.1 · our assessment: act_now Reference: https://lists.apache.org/thread/2vkcj3bdvso6cywnklt2vtkc2m4o0b5c Details: https://vuln.today/cve/CVE-2026-60053