{"id":"CVE-2026-117532","published":"2026-10-27T11:17:33.597","lastModified":"2026-10-27T15:02:47.683","description":"REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in the structure/history plugin that allows unauthenticated attackers to forge temporary login tokens. Attackers can force the session-tied secret into a predictable state and forge tokens for accounts like admin, gaining backend access and code execution outside live mode.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-287"],"vendors":[],"products":[],"references":[{"url":"https://github.com/redaxo/core/security/advisories/GHSA-px8f-whj8-hrpq","tags":[]},{"url":"https://www.vulncheck.com/advisories/redaxo-core-5.3.0-before-5.21.4-authentication-bypass-via-history-plugin","tags":[]}],"exploitRefs":[{"url":"https://github.com/redaxo/core/security/advisories/GHSA-px8f-whj8-hrpq","tags":[]}],"hasPoc":true,"ai":{"summary":"The REDAXO core structure/history plugin before version 5.21.4 contains a CWE-287 authentication bypass flaw that allows unauthenticated attackers to forge temporary login tokens by forcing the session-tied secret into a predictable state, enabling full backend access and code execution outside live mode.","exploitability":"Exploitation is straightforward for remote attackers as it requires no authentication, minimal user interaction, and leverages predictable token generation logic in the affected plugin versions.","blast_radius":"Successful exploitation grants unauthenticated remote attackers full administrative control over the REDAXO backend, enabling complete compromise of confidentiality, integrity, and availability including arbitrary code execution.","remediation":"Upgrade to REDAXO core version 5.21.4 or later, which contains the official fix for this authentication bypass vulnerability in the structure/history plugin.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","rce","web","core-vulnerability","cwe-287"],"model":"garnet-coder","analyzedAt":"2026-10-28T10:00:46.326Z"}}