REDAXO CMS CVE-2026-116894

Exploitation requires that the attacker has ALREADY obtained the victim backend user's PHP session id or their 'stay logged in' cookie through a separate vector (the advisory names malware, a shared computer, or another vulnerability) - this theft is an explicit precondition and not part of the flaw itself. The weakness specifically affects REDAXO backend sessions where, on a password change, the current session id is not regenerated and (if 'stay logged in' was enabled) the stay-logged-in key is not renewed, leaving the stolen credential valid for up to three months. Limiting factors that reduce realistic risk: both the session id and stay-logged-in key are stored in HttpOnly cookies, so client-side script cannot read them; the attacker must already hold a valid session/cookie; and the vendor workaround of logging out after the password change fully removes the current session and its key. Only the REDAXO backend is affected.

All decision signals converge on low real-world urgency. The vendor CVSS 4.0 base score is 2.3 (Low), the vuln.today decision label is 'monitor', and the CISA SSVC framework records Exploitation: none, Automatable: no, Technical Impact: partial - a fully consistent low-priority picture with no conflicting signals. This is not actively exploited: there is no CISA KEV listing and no EPSS score was supplied in the input, so widespread-exploitation probability cannot be quantified from this data. Critically, the vulnerability is a post-compromise persistence weakness, not an initial-access flaw: the GHSA advisory explicitly states that obtaining the session id or stay-logged-in cookie is a precondition and NOT part of this vulnerability (AT:P in the CVSS 4.0 vector reflects that attack requirement). The network vector (AV:N) and PR:L indicate an authenticated-context issue reached over the network, which is consistent with the description - an attacker leveraging an already-stolen backend session. This is a genuine but low-severity session-management hygiene issue (CWE-613), relevant mainly because password change is the natural response to suspected compromise and here it fails to fully evict the attacker; it is not a high-priority emergency.

An attacker who has already obtained a backend user's session id or 'stay logged in' cookie (e.g. via malware, a shared computer, or a separate vulnerability) continues to access the REDAXO backend even after the user changes their password in response to the suspected compromise. Because the stay-logged-in key is not renewed on password change and only checks the current database password hash, the stolen cookie remains valid for up to three months. No public exploit code is identified in the provided sources; only the fix commit and vendor/GHSA advisories are referenced.