Penpot CVE-2026-105690

Exploitation requires the attacker to already hold a valid auth-token cookie for the victim's Penpot account captured before logout (the server-side record in the http_session_v2 table is never deleted on logout in versions prior to 2.18.0). The attack is limited by: (1) the need to obtain the token first via a separate vector (shared machine, interception, or XSS), (2) the fact that the stolen token only remains valid until its natural expiration rather than indefinitely, and (3) user interaction in that the scenario centers on the victim having logged out and wrongly assuming the session is terminated. Only the specific captured session is affected; other sessions and credential changes are not the vector.

This is a genuine but moderate-severity session-management flaw (CWE-613, Insufficient Session Expiration), confirmed by the vendor's own GitHub Security Advisory GHSA-mj9f-5cwq-7p3q and the fixing commit (7c85837) which corrects logout to delete the server-side session record rather than merely clearing the client cookie. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N, 5.9 Medium) is internally consistent with the description: network-reachable, but high complexity because the attacker must already possess a captured session token, and user interaction (the victim logging out) is the trigger for the scenario. No EPSS score, CISA KEV listing, or public POC was provided in the intelligence set, so exploitation status is 'no public exploit identified at time of analysis.' The practical risk is bounded: although CVSS marks PR:N (the attacker needs no account of their own), real-world exploitation is predicated on prior token theft, which is the hard precondition the AC:H metric reflects. This is therefore a legitimate fix-worthy issue but not an emergency - it meaningfully weakens logout as a mitigation (e.g., on shared or compromised machines) rather than offering a standalone remote compromise path. Absence of EPSS/KEV/POC data means widespread opportunistic exploitation is unlikely to be measurable; treat as a defense-in-depth priority for self-hosted Penpot operators.

An attacker who has already captured a victim's auth-token cookie (for example on a shared workstation, via network interception, or through a prior XSS) retains full use of that token even after the victim clicks 'log out,' because the server never invalidates the session. The attacker then replays the token to make authenticated requests with the victim's identity until the token naturally expires. No public exploit code is referenced, and the capture step is the limiting factor reflected by the high attack complexity.