CVE-2026-128330

MediumCVSS 4.2/10Last modified Nov 13, 2026

Description

Miniflux before 2.3.5 contains an insufficient session expiration vulnerability that allows attackers to retain account access because password changes do not revoke existing web sessions. Attackers holding a leaked password or copied session cookie keep access for up to 30 days, reading integration credentials, creating API keys, or registering passkeys.

Metrics

CVSS 3.1 4.2/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-613

Affected software

No affected versions have been published.

Timeline

Published
Nov 13, 2026
Last modified
Nov 13, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1283315.3Miniflux before 2.3.5 contains an unverified password change vulnerability that allows holders of a signed-in session to change the account CVE-2026-1283327.4Listmonk 6.0.0 before 7.0.0-beta.2 contains a 2FA bypass vulnerability that allows attackers with a valid password to brute-force TOTP codesCVE-2026-1283337.4listmonk 6.0.0 before 7.0.0-beta.2 contains an authentication bypass vulnerability in doResetPassword that skips TOTP verification after a pCVE-2026-1283344.8listmonk 6.2.0 before 7.0.0-beta.2 contains a missing authentication vulnerability that allows unauthenticated attackers to submit Azure EveCVE-2026-1283353.7Contao 4.6.0 before 5.3.54, 5.4.0-RC1 before 5.7.17, and 6.0.0-RC1 before 6.0.6 fails to invalidate existing user sessions when two-factor aCVE-2026-1283364.8ExcelJS through 4.4.0 contains a prototype pollution vulnerability that allows attackers to add numeric keys to Object.prototype through a cCVE-2026-1283377.0ExcelJS through 4.4.0 contains a prototype pollution vulnerability in mergeConditionalFormattings that allows attackers to modify Object.proCVE-2026-1283387.5exceljs through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by supplying a worksheet col elCVE-2026-1283397.5ExcelJS through 4.4.0 contains a memory exhaustion vulnerability in Worksheet._parseMergeCells that allows attackers to crash applications bCVE-2026-1283407.5ExcelJS through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by supplying a workbook with anCVE-2026-1283417.5ExcelJS through 4.4.0 contains a resource exhaustion vulnerability in data-validations-xform.js that allows attackers to exhaust CPU and memCVE-2026-1283427.5ExcelJS through 4.4.0 contains a denial of service vulnerability that allows attackers to block the event loop by supplying an unbounded she
CVE-2026-128330: Medium severity, CVSS 4.2 | Vulnix