CVE-2026-105690 in Penpot
Summary
by MITRE • 10/06/2026
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, logout clears the browser's auth-token cookie without revoking the corresponding server-side session. A previously captured session token remains usable after the victim logs out and can continue to make authenticated requests with the victim's authority until natural expiration. This issue is fixed in version 2.18.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/06/2026
The vulnerability identified in Penpot prior to version 2.18.0 represents a critical authentication state management flaw, specifically categorized under CWE-613: Insufficient Session Expiration. In modern web applications, the security of user sessions relies on a synchronized lifecycle between client-side tokens and server-side session records. When a user initiates a logout action, the application is responsible for invalidating both the local storage mechanism, such as browser cookies or local storage items, and the corresponding backend session identifier stored in the database or cache. In this specific instance, Penpot’s implementation only addressed the client side by clearing the authentication token cookie from the user's browser. This partial cleanup creates a significant security gap because it fails to notify the server that the active session is no longer valid for that particular user identity.
From an operational perspective, this flaw allows for what is known as a stale session attack or unauthorized continued access via captured tokens. An attacker who has previously intercepted or stolen the authentication token through network sniffing, cross-site scripting, or other means can continue to utilize this token even after the legitimate victim has logged out of their account. Since the server-side session remains active and unrevoked, any request made with the old token is still processed as authenticated and authorized under the victim's privileges. This effectively negates the security benefit of logging out, leaving sensitive design files, prototyping data, and potentially associated project information exposed to unauthorized access for the duration of the original session timeout period.
This behavior aligns closely with MITRE ATT&CK technique T1078: Valid Accounts, where an adversary maintains persistence or continues operations using legitimate credentials that have not been properly invalidated by the system administrator or user action. The impact is particularly severe in collaborative design environments like Penpot, where multiple users may share access to sensitive intellectual property. If a designer logs out of their workstation but does not log out on shared devices or if an attacker has already captured the token during active work, they retain full administrative control over that session until it naturally expires based on server-side configuration settings such as idle timeout or absolute lifetime limits.
To mitigate this vulnerability and prevent similar issues in future implementations, developers must ensure strict synchronization between client and server authentication states. Upon receiving a logout request, the backend service should immediately invalidate the corresponding session identifier by deleting it from the database or marking it as expired in the cache layer. Additionally, implementing short-lived access tokens paired with refresh token rotation can reduce the window of opportunity for attackers to exploit stale sessions. Organizations relying on Penpot versions prior to 2.18.0 are strongly advised to upgrade immediately to patch this authentication bypass flaw and ensure that session termination is handled comprehensively across all layers of the application architecture.