CVE-2026-117532
REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in the…
- Risk score
- 64/100
- CVSS
- 9.8 v3.1
- Published
- 27 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in the structure/history plugin that allows unauthenticated attackers to forge temporary login tokens. Attackers can force the session-tied secret into a predictable state and forge tokens for accounts like admin, gaining backend acce…
- Affected
- See advisory
- Fix
- Upgrade the product to 5.21.4 or later.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 9.8 critical
- Remotely exploitable without logging in
References
Original description
REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in the structure/history plugin that allows unauthenticated attackers to forge temporary login tokens. Attackers can force the session-tied secret into a predictable state and forge tokens for accounts like admin, gaining backend access and code execution outside live mode.
Last activity 27 Oct 2026. Patch Forecast updates every hour.