{"id":"CVE-2026-84155","published":"2026-11-06T11:17:17.043","lastModified":"2026-11-10T18:17:48.857","description":"CodeChecker's web server fails to fully invalidate a session token on logout when the server runs with more than one API worker process (the default). Each worker process maintains its own\nin-memory session cache; logout only clears the cache of the single worker that handles the request (plus the shared database record). Other workers continue to honor the destroyed token\nfrom their stale in-memory copies until the session's lifetime expires. An attacker who has captured a valid token can therefore keep impersonating the user after the user has logged out.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-613"],"vendors":[],"products":[],"references":[{"url":"https://github.com/Ericsson/codechecker/security/advisories/GHSA-r42x-9wgw-cqc2","tags":[]},{"url":"https://github.com/Ericsson/codechecker/security/advisories/GHSA-r42x-9wgw-cqc2","tags":[]}],"exploitRefs":[{"url":"https://github.com/Ericsson/codechecker/security/advisories/GHSA-r42x-9wgw-cqc2","tags":[]},{"url":"https://github.com/Ericsson/codechecker/security/advisories/GHSA-r42x-9wgw-cqc2","tags":[]}],"hasPoc":true,"ai":null}