Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

REDAXO core lets attackers log in as admin

CVE-2026-117532 · published today
Summary

Versions of REDAXO core from 5.3.0 up to 5.21.3 let unauthenticated users create fake login tokens and gain back‑end access, including the ability to run code. This is possible through a flaw in the history plugin that makes the session secret predictable. Updating to REDAXO core 5.21.4 or later fixes the issue; apply the update as soon as possible.

What to do
  • Update redaxo core to version 5.21.4 or later.
Affected software
VendorProductAffected versions
redaxo core < 5.21.4
Original advisory text
REDAXO Core 5.3.0 before 5.21.4 Authentication Bypass via History Plugin
REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in the structure/history plugin that allows unauthenticated attackers to forge temporary login tokens. Attackers can force the session-tied secret into a predictable state and forge tokens for accounts like admin, gaining backend access and code execution outside live mode.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.3 Critical
Type
CWE-287Improper Authentication
Timeline
Published27 Oct 2026
Updated27 Oct 2026
First seen27 Oct 2026
Sources
CVE-2026-117532 · NVD
CVE-2026-117532 · MITRE
Track software like this
Free during beta