EUVD-2026-35085Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Lifecycle Timeline
3DescriptionGitHub Advisory
Bludit is a content management system. Versions prior to 3.22.0 have a vulnerability in the user management logic that allows deactivated accounts to maintain access via persistent authentication tokens. When an administrator disables a user account, the application fails to invalidate or clear the associated tokenAuth and tokenRemember fields in the JSON database. Consequently, any user with a pre-existing "Remember Me" cookie can bypass the account disablement and maintain a valid authenticated state. Version 3.22.0 patches the issue.
AnalysisAI
Authentication bypass in Bludit CMS versions prior to 3.22.0 allows deactivated user accounts to retain authenticated access through persistent 'Remember Me' cookies, because the disable-account workflow fails to invalidate tokenAuth and tokenRemember values stored in the JSON database. Any user who previously logged in with the persistent session option can continue to act with their original privileges even after an administrator disables them. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must already possess a valid 'Remember Me' (tokenRemember) cookie issued by the target Bludit instance before the account was disabled, meaning they previously authenticated at least once with the persistent-session option checked. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N yields 7.1 (High) and aligns with the described abuse path: a network-reachable attacker who previously held low-privileged credentials and a Remember Me cookie can read high-confidentiality content and perform limited integrity changes, with no availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A contractor with an editor account logs into Bludit with 'Remember Me' enabled, obtaining a persistent cookie. After the engagement ends an administrator disables the account in the Bludit UI, but because tokenRemember is never cleared the contractor's browser continues to present the cookie and is silently re-authenticated, allowing continued read access to draft content and limited content modifications. … |
| Remediation | Vendor-released patch: Bludit 3.22.0, which adds session invalidation for disabled users per release note 'Fix: Invalidate sessions for disabled users (GHSA-q42h-wpg8-5wwf)'; upgrade via https://github.com/bludit/bludit/releases/tag/3.22.0 and consult the advisory at https://github.com/bludit/bludit/security/advisories/GHSA-ggqg-xvx6-hgwh. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all Bludit CMS instances and their versions; identify and document all deactivated user accounts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today