CVE-2026-128330
Miniflux before 2.3.5 contains an insufficient session expiration vulnerability that allows attackers to retain account access because passw
CVSS
4.2
Medio
EPSS
—
KEV
—
Exploit Today
0
0-100
Publicado: 13 nov 2026 · Última mod.: 13 nov 2026 · CWE-613
Sin historial EPSS suficiente todavía.
Miniflux before 2.3.5 contains an insufficient session expiration vulnerability that allows attackers to retain account access because password changes do not revoke existing web sessions. Attackers holding a leaked password or copied session cookie keep access for up to 30 days, reading integration credentials, creating API keys, or registering passkeys.
- github.comhttps://github.com/miniflux/v2/blob/v2.3.4/internal/storage/user.go#L174-L190
- github.comhttps://github.com/miniflux/v2/commit/229035a4df6e60107d1117eb50696b23e08cb4b8
- github.comhttps://github.com/miniflux/v2/pull/4594
- github.comhttps://github.com/miniflux/v2/releases/tag/v2.3.5
- github.comhttps://github.com/miniflux/v2/security/advisories/GHSA-ch38-3q93-fwg8
- www.vulncheck.comhttps://www.vulncheck.com/advisories/miniflux-before-2.3.5-insufficient-session-expiration-after-password-change
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-927386.8 MED—
———Vault's Login MFA feature did not consistently enforce the lifetime of pending two-phase login requests. This may allow a user who previously completed the first authentication factor to complete MFA and obtain a Vault token after the pending request should have expired, including after the user's primary credential has been rotated. This vulnerability (CVE-2026-92738) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.26.4hCVE-2026-1283353.7 BAJ—
——0Contao 4.6.0 before 5.3.54, 5.4.0-RC1 before 5.7.17, and 6.0.0-RC1 before 6.0.6 fails to invalidate existing user sessions when two-factor authentication is enabled or disabled. Because Contao\User::isEqualTo() and serialized session data omit two-factor state, attackers already holding a session keep it after the owner changes 2FA settings.8hCVE-2026-1280305.9 MED—
——0OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an insufficient session expiration vulnerability because Mage_Api_Model_Session::_renewBySessId() never checks api_user.is_active and REST OAuth authorization never checks whether the admin user is active. Attackers holding an existing SOAP/XML-RPC session or OAuth access token retain API access after deactivation or API key rotation, reading and modifying customer, order and catalog data.10hCVE-2026-1264536.5 MED—
——0OpenEMR before 8.5.0 contains an inverted comparison in Document::has_expired() that causes the FHIR Binary download endpoint to treat time-limited PHI documents as unexpired after their one-hour lifetime. Authenticated users still authorized for a Binary/{id} resource can download expired bulk export NDJSON files and $docref CCDs indefinitely.15hCVE-2026-1264274.6 MED—
——0OpenEMR before 8.5.0 contains a session expiration vulnerability that prevents automatic logoff because the Eye Exam form's read-only poll omits skip_timeout_reset. Attackers with physical access to an unattended workstation can use the still-active session to view patient health information, since update_READONLY() resets the idle timer every 15 seconds.9hCVE-2026-1266585.4 MED14.2%
——4ByteStash 1.5.10 before 1.6.2 contains an insufficient session expiration vulnerability that allows holders of API keys to keep access after account deactivation because validateApiKey never checks account status. Attackers holding a deactivated account's API key can read, create, modify and delete its snippets via /api/snippets and use every MCP tool via /mcp.7h