CVE-2026-73611 in File Browser
Summary
by MITRE • 08/13/2026
File Browser versions from 2.50.0 through 2.63.21 fail to validate JWT expiration when proxy authentication is configured with a non-default logout page. Attackers with a previously valid token can access protected routes and administrative endpoints indefinitely, and exchange expired tokens for fresh ones via the renewal endpoint.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/13/2026
This vulnerability exists in File Browser versions ranging from 250.0 to 263.21 where the application fails to properly validate JSON Web Token expiration times when using proxy authentication with custom logout page configurations. The flaw stems from inadequate session management mechanisms that allow authenticated users to maintain access beyond their intended token lifespan, creating a persistent security risk for systems relying on this file sharing platform.
The technical implementation defect occurs within the authentication validation logic where the system accepts and processes JWT tokens without verifying their expiration timestamps. This represents a critical weakness in access control enforcement as defined by CWE-287 - Improper Authentication, where the application fails to properly validate session tokens or credentials. When proxy authentication is configured with non-default logout page settings, the vulnerability becomes exploitable through a specific attack vector that bypasses normal token lifecycle management.
The operational impact of this vulnerability extends beyond simple unauthorized access to include potential administrative privilege escalation and persistent system compromise. An attacker who obtains a valid JWT token during a legitimate session can maintain indefinite access to protected routes and administrative endpoints even after the token should have expired. This behavior effectively nullifies the intended security controls around session duration and access revocation, creating a backdoor that persists until the system is restarted or manually intervened.
The vulnerability is particularly concerning because it enables attackers to exchange expired tokens for fresh ones through a legitimate renewal endpoint, essentially creating a mechanism for indefinite token reuse. This capability aligns with ATT&CK technique T1566.002 - Phishing: Spearphishing Attachment and represents how compromised credentials can be weaponized to maintain persistent access. The flaw allows attackers to extend their session indefinitely without requiring additional authentication factors or re-authentication mechanisms.
Organizations should immediately implement mitigations including updating to patched versions of File Browser, implementing proper token validation mechanisms, and configuring monitoring for unauthorized access attempts. System administrators should also review proxy authentication configurations to ensure default logout pages are used when possible, and consider implementing additional access controls such as IP whitelisting or multi-factor authentication. The vulnerability demonstrates the importance of proper session management and token lifecycle enforcement in web applications, reinforcing the need for comprehensive authentication validation processes that adhere to security best practices established by industry standards including NIST SP 800-63B for digital identity management and authentication protocols.