Monthly
Stale authentication state in GraphQL Tools' legacy WebSocket executor lets a later caller inherit a previous caller's downstream identity: the closure-scoped executorConnectionParams object retains per-request extensions.connectionParams after cleanupWebsocket tears down the socket, and the retained keys are replayed in a subsequent connection_init payload. Only applications that reuse a single buildWSLegacyExecutor instance across different authorization contexts are exposed - most notably gateway, schema-stitching, or GraphQL Mesh deployments that pass per-user Authorization or tenant values through extensions.connectionParams; an anonymous or lower-privileged request that omits the sensitive key can then have its downstream subscription executed under the earlier user's token, though the credential itself is never disclosed. Applications that build a fresh executor per request, including the in-repository UrlLoader wrapper, are not affected; exploitation is remote and unauthenticated from the library's perspective but gated by the shared-executor architecture, and no public exploit code was identified at time of analysis.
OAuth token revocation in WSO2 Identity Server fails to invalidate access and refresh tokens for accounts whose usernames contain mixed-case characters when the deployment pairs a case-insensitive user store with a case-sensitive identity database. An authenticated attacker (PR:L) who already holds a valid, unexpired token for such an account can keep using it for actions that should have been blocked after a revocation-triggering lifecycle event, bounded by the token's natural expiry. Affected deployments are a non-default configuration subset, the trigger requires that specific store/database mismatch plus a mixed-case username, and no public exploit has been identified at time of analysis; the input 7.4 score assumes AC:L, whereas the assessed vector uses AC:H, so real-world risk is materially lower than the headline number suggests.
Session tokens issued by the Kiloview E3 web management interface on login are given an expiration far beyond any reasonable session lifetime, so a token obtained through interception or device compromise keeps granting authenticated access long after it should have lapsed. The issue is tracked as CWE-613 (insufficient session expiration) against Kiloview E3 firmware and carries a CVSS 8.3 base score; the CVSS vector includes PR:N, although practical exploitation first requires the attacker to capture a valid token, which is why the assessed attack complexity is High. No public exploit code has been identified at time of analysis, and the authoritative reporting is CISA ICS advisory ICSA-26-295-01, filed by ICS-CERT and prioritized as 'this week' rather than emergency action.
Session token replay in the WebFig management interface of MikroTik RouterOS (through 7.24.5) lets an attacker who already possesses a captured administrator session token bypass authentication and gain persistent administrative access, because tokens stay valid across newly negotiated ECDH sessions until the device's login store is explicitly cleared. The 9.1 CVSS v4 score reflects high confidentiality and integrity impact, but its AC:H rating is meaningful: the attacker must first obtain a valid token out-of-band, for example through the unfixed transport-layer exposure described in CVE-2025-61481, and no user interaction is needed once a token is held. No public exploit identified at time of analysis and no CISA KEV entry exists; devices whose WebFig interface is not reachable from untrusted networks are not realistically exposed.
Vikunja 0.22.0 through 2.6.0 fails to revoke webhook and link-share channels when a collaborator's project access is removed, so a former collaborator who created a webhook while still authorized continues to receive task titles and descriptions - including content created after revocation - as an automatic live feed. The cleanup routine that deletes derived rows (assignees, subscriptions) does not include webhooks or link shares, and it is only wired to the team-member removal path, leaving direct project-user removal, permission downgrade, and team-project removal without any cleanup. Per the assessed vector (AV:N/AC:L/PR:L/UI:N/C:H), the attacker must have been a legitimate authenticated collaborator who previously registered a webhook, gains read-only disclosure only, and no public exploit code has been identified at time of analysis.
Revoked Vikunja sessions retain live WebSocket access: in versions 2.3.0 through 2.6.0 the /api/v2/ws endpoint authenticates the first client message by verifying only the JWT signature and token type, never resolving the token's 'sid' claim against the sessions table, so a stolen access token can still open a new connection or keep an existing one alive after DELETE /api/v2/user/sessions/{id} or after TOTP enrollment wipes all sessions. The impact is confidentiality-only: the attacker continues to receive notification.created pushes carrying comment, task and project content belonging to the victim's account, which the vendor scores 7.1 under CVSS 4.0 (PR:L, VC:H) and our assessment scores 6.5 under CVSS 3.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Exploitation requires an authenticated attacker who already holds a valid, unexpired user access token - there is no initial-access path in this defect - and no public exploit code or CISA KEV entry was identified at time of analysis.
Insufficient session expiration in Progress MOVEit Transfer (versions before 2025.1.6, and 2026.0.0 through 2026.0.3) allows an attacker who obtains a still-valid session artifact - a token captured in transit, left behind on a shared or public workstation, or never revoked after logout or a credential change - to keep using that session beyond its intended lifetime, exposing managed file transfer data and functionality. No account of the attacker's own is required (CVSS PR:N), but exploitation is gated on a valid, reachable leftover token existing, which is why our independent assessment scores it AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:N rather than the vendor's 9.8 - the flaw does not by itself yield code execution or availability impact. There is no confirmed active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, and EPSS is only 0.31% (23rd percentile), so real-world risk is materially lower than the headline score suggests. Patches are available from Progress.
Wazuh Manager 4.0.0 through 4.14.7 fails to consult its token revocation blacklist inside the check_token routine, so a previously issued administrator JWT remains usable after the administrator grant behind it has been revoked. The bypass specifically affects run_as users that have zero static roles: such an account can keep authenticating with the stale token and self-link the administrator role, permanently re-acquiring privileged access it was supposed to have lost. Exploitation requires an already authenticated actor who previously held high privileges (CVSS vector PR:H), meaning the realistic threat is insider or post-offboarding privilege retention rather than external compromise; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and a vendor-released patch is available as 4.14.8.
OTRS fails to immediately invalidate previously issued JWT authentication tokens when an agent or customer user account is deactivated or its password is changed, leaving tokens valid until their normal expiration (approximately 16 hours). An attacker who already possesses a valid token can continue accessing OTRS with the associated privileges, though customer tokens are limited to that account and agent tokens may reach broader ticket, customer, or administrative functions. The flaw provides no way to obtain a token; exploitation requires prior token possession, and the provided CVSS 9.1 (PR:N) overstates ease of attack because it does not account for this prerequisite. No public exploit identified at time of analysis.
SmarterMail before build 9777 fails to revalidate the role claim embedded in JWT access and refresh tokens when a token is redeemed at POST /api/v1/auth/refresh-token, so an authenticated attacker (PR:L) who holds a refresh token issued before an administrator demotion can replay it to mint a new access token that still carries the higher-privilege role, such as DomainAdmin or SysAdmin. The exposure is bounded by the token's natural expiry and only matters in environments where privileged accounts are actually demoted or revoked, since the attacker must either be the demoted user or have captured their pre-demotion token. No public exploit code has been identified at time of analysis, there is no KEV listing, and the independent assessment rates this a credible mid-to-high priority issue rather than an emergency.
Stale authentication state in GraphQL Tools' legacy WebSocket executor lets a later caller inherit a previous caller's downstream identity: the closure-scoped executorConnectionParams object retains per-request extensions.connectionParams after cleanupWebsocket tears down the socket, and the retained keys are replayed in a subsequent connection_init payload. Only applications that reuse a single buildWSLegacyExecutor instance across different authorization contexts are exposed - most notably gateway, schema-stitching, or GraphQL Mesh deployments that pass per-user Authorization or tenant values through extensions.connectionParams; an anonymous or lower-privileged request that omits the sensitive key can then have its downstream subscription executed under the earlier user's token, though the credential itself is never disclosed. Applications that build a fresh executor per request, including the in-repository UrlLoader wrapper, are not affected; exploitation is remote and unauthenticated from the library's perspective but gated by the shared-executor architecture, and no public exploit code was identified at time of analysis.
OAuth token revocation in WSO2 Identity Server fails to invalidate access and refresh tokens for accounts whose usernames contain mixed-case characters when the deployment pairs a case-insensitive user store with a case-sensitive identity database. An authenticated attacker (PR:L) who already holds a valid, unexpired token for such an account can keep using it for actions that should have been blocked after a revocation-triggering lifecycle event, bounded by the token's natural expiry. Affected deployments are a non-default configuration subset, the trigger requires that specific store/database mismatch plus a mixed-case username, and no public exploit has been identified at time of analysis; the input 7.4 score assumes AC:L, whereas the assessed vector uses AC:H, so real-world risk is materially lower than the headline number suggests.
Session tokens issued by the Kiloview E3 web management interface on login are given an expiration far beyond any reasonable session lifetime, so a token obtained through interception or device compromise keeps granting authenticated access long after it should have lapsed. The issue is tracked as CWE-613 (insufficient session expiration) against Kiloview E3 firmware and carries a CVSS 8.3 base score; the CVSS vector includes PR:N, although practical exploitation first requires the attacker to capture a valid token, which is why the assessed attack complexity is High. No public exploit code has been identified at time of analysis, and the authoritative reporting is CISA ICS advisory ICSA-26-295-01, filed by ICS-CERT and prioritized as 'this week' rather than emergency action.
Session token replay in the WebFig management interface of MikroTik RouterOS (through 7.24.5) lets an attacker who already possesses a captured administrator session token bypass authentication and gain persistent administrative access, because tokens stay valid across newly negotiated ECDH sessions until the device's login store is explicitly cleared. The 9.1 CVSS v4 score reflects high confidentiality and integrity impact, but its AC:H rating is meaningful: the attacker must first obtain a valid token out-of-band, for example through the unfixed transport-layer exposure described in CVE-2025-61481, and no user interaction is needed once a token is held. No public exploit identified at time of analysis and no CISA KEV entry exists; devices whose WebFig interface is not reachable from untrusted networks are not realistically exposed.
Vikunja 0.22.0 through 2.6.0 fails to revoke webhook and link-share channels when a collaborator's project access is removed, so a former collaborator who created a webhook while still authorized continues to receive task titles and descriptions - including content created after revocation - as an automatic live feed. The cleanup routine that deletes derived rows (assignees, subscriptions) does not include webhooks or link shares, and it is only wired to the team-member removal path, leaving direct project-user removal, permission downgrade, and team-project removal without any cleanup. Per the assessed vector (AV:N/AC:L/PR:L/UI:N/C:H), the attacker must have been a legitimate authenticated collaborator who previously registered a webhook, gains read-only disclosure only, and no public exploit code has been identified at time of analysis.
Revoked Vikunja sessions retain live WebSocket access: in versions 2.3.0 through 2.6.0 the /api/v2/ws endpoint authenticates the first client message by verifying only the JWT signature and token type, never resolving the token's 'sid' claim against the sessions table, so a stolen access token can still open a new connection or keep an existing one alive after DELETE /api/v2/user/sessions/{id} or after TOTP enrollment wipes all sessions. The impact is confidentiality-only: the attacker continues to receive notification.created pushes carrying comment, task and project content belonging to the victim's account, which the vendor scores 7.1 under CVSS 4.0 (PR:L, VC:H) and our assessment scores 6.5 under CVSS 3.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Exploitation requires an authenticated attacker who already holds a valid, unexpired user access token - there is no initial-access path in this defect - and no public exploit code or CISA KEV entry was identified at time of analysis.
Insufficient session expiration in Progress MOVEit Transfer (versions before 2025.1.6, and 2026.0.0 through 2026.0.3) allows an attacker who obtains a still-valid session artifact - a token captured in transit, left behind on a shared or public workstation, or never revoked after logout or a credential change - to keep using that session beyond its intended lifetime, exposing managed file transfer data and functionality. No account of the attacker's own is required (CVSS PR:N), but exploitation is gated on a valid, reachable leftover token existing, which is why our independent assessment scores it AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:N rather than the vendor's 9.8 - the flaw does not by itself yield code execution or availability impact. There is no confirmed active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, and EPSS is only 0.31% (23rd percentile), so real-world risk is materially lower than the headline score suggests. Patches are available from Progress.
Wazuh Manager 4.0.0 through 4.14.7 fails to consult its token revocation blacklist inside the check_token routine, so a previously issued administrator JWT remains usable after the administrator grant behind it has been revoked. The bypass specifically affects run_as users that have zero static roles: such an account can keep authenticating with the stale token and self-link the administrator role, permanently re-acquiring privileged access it was supposed to have lost. Exploitation requires an already authenticated actor who previously held high privileges (CVSS vector PR:H), meaning the realistic threat is insider or post-offboarding privilege retention rather than external compromise; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and a vendor-released patch is available as 4.14.8.
OTRS fails to immediately invalidate previously issued JWT authentication tokens when an agent or customer user account is deactivated or its password is changed, leaving tokens valid until their normal expiration (approximately 16 hours). An attacker who already possesses a valid token can continue accessing OTRS with the associated privileges, though customer tokens are limited to that account and agent tokens may reach broader ticket, customer, or administrative functions. The flaw provides no way to obtain a token; exploitation requires prior token possession, and the provided CVSS 9.1 (PR:N) overstates ease of attack because it does not account for this prerequisite. No public exploit identified at time of analysis.
SmarterMail before build 9777 fails to revalidate the role claim embedded in JWT access and refresh tokens when a token is redeemed at POST /api/v1/auth/refresh-token, so an authenticated attacker (PR:L) who holds a refresh token issued before an administrator demotion can replay it to mint a new access token that still carries the higher-privilege role, such as DomainAdmin or SysAdmin. The exposure is bounded by the token's natural expiry and only matters in environments where privileged accounts are actually demoted or revoked, since the attacker must either be the demoted user or have captured their pre-demotion token. No public exploit code has been identified at time of analysis, there is no KEV listing, and the independent assessment rates this a credible mid-to-high priority issue rather than an emergency.