CVE-2026-116894 in Redaxo
Summary
by MITRE • 10/27/2026
REDAXO before 5.21.5 contains an insufficient session expiration vulnerability that allows attackers to retain account access by keeping the current session and stay-logged-in key valid after a password change. Attackers who obtained a user's session id or stay-logged-in cookie can keep backend access after the password change, via the cookie for up to three months.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/27/2026
The vulnerability identified in REDAXO versions prior to 5.21.5 represents a critical failure in session management and credential rotation protocols. Specifically, the application fails to invalidate existing authentication tokens when a user's credentials are modified. This architectural flaw allows an attacker who has already obtained a valid session identifier or stay-logged-in cookie through methods such as cross-site scripting, network sniffing, or session hijacking to maintain persistent access to the backend administrative interface even after the legitimate user changes their password. The persistence of these tokens for up to three months significantly extends the window of opportunity for unauthorized actors to exploit compromised credentials without detection.
From a technical perspective, this issue stems from an insufficient expiration mechanism tied to credential updates. When a password is changed, standard security practices dictate that all active sessions associated with that user account should be terminated immediately to prevent replay attacks or session fixation exploits. In REDAXO versions affected by this vulnerability, the backend logic does not trigger a revocation of existing tokens upon password modification. Consequently, the stay-logged-in cookie and the current session ID remain valid within the application's authentication state machine. This indicates that the system relies on static token validity periods rather than dynamic validation against a central credential change timestamp or blacklist.
The operational impact of this vulnerability is severe for organizations relying on REDAXO for content management, particularly those handling sensitive data or requiring strict access controls. An attacker with prior knowledge of a user's session ID can bypass the primary defense mechanism of password rotation. This effectively neutralizes one of the most common incident response actions taken when a compromise is suspected. The ability to retain backend access for up three months allows attackers ample time to exfiltrate data, install persistent backdoors, or modify content without triggering alerts based on credential changes. This persistence complicates forensic investigations and increases the potential damage from any initial breach.
This vulnerability aligns with CWE-613, which classifies insufficient session expiration as a weakness where authentication credentials are not properly invalidated after use or change. Furthermore, it relates to ATT&CK technique T1078, Valid Accounts, specifically in the context of persistence through maintained access rather than initial compromise. The failure to revoke sessions upon password reset also touches upon CWE-384, Session Fixation, as the application allows a previously established session identifier to remain active despite changes to the underlying authentication secret.
To mitigate this risk, organizations must upgrade REDAXO to version 5.21.5 or later where these session management protocols have been corrected. In environments where immediate patching is not feasible, administrators should implement compensating controls such as enforcing shorter stay-logged-in cookie lifespans through configuration if available, and monitoring for unusual login patterns that might indicate the use of stale sessions. Additionally, implementing multi-factor authentication can reduce the impact of session hijacking by requiring a second factor even if the session token is compromised. Regular audits of active sessions and immediate invalidation policies upon any credential change are essential best practices to prevent similar vulnerabilities in other applications within the infrastructure.