Bludit up to 3.21.x User Management tokenAuth/tokenRemember improper removal of sensitive information before storage or transfer

Summaryinfo

A vulnerability identified as critical has been detected in Bludit up to 3.21.x. Impacted is an unknown function of the component User Management Handler. Performing a manipulation of the argument tokenAuth/tokenRemember results in improper removal of sensitive information before storage or transfer. This vulnerability is identified as CVE-2026-46657. The attack can be initiated remotely. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Bludit up to 3.21.x. It has been classified as critical. This affects some unknown functionality of the component User Management Handler. The manipulation of the argument tokenAuth/tokenRemember with an unknown input leads to a improper removal of sensitive information before storage or transfer vulnerability. CWE is classifying the issue as CWE-212. The product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Bludit is a content management system. Versions prior to 3.22.0 have a vulnerability in the user management logic that allows deactivated accounts to maintain access via persistent authentication tokens. When an administrator disables a user account, the application fails to invalidate or clear the associated tokenAuth and tokenRemember fields in the JSON database. Consequently, any user with a pre-existing "Remember Me" cookie can bypass the account disablement and maintain a valid authenticated state. Version 3.22.0 patches the issue.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-46657 since 05/15/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1592 according to MITRE ATT&CK.

Upgrading to version 3.22.0 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• Bludit

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.4
• 3.5
• 3.6
• 3.7
• 3.8
• 3.9
• 3.10
• 3.11
• 3.12
• 3.13
• 3.14
• 3.15
• 3.16
• 3.17
• 3.18
• 3.19
• 3.20
• 3.21

Website

• Product: https://github.com/bludit/bludit/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion