CVE-2026-60053

CriticalCVSS 9.1/10Last modified Oct 24, 2026

Description

Insufficient Session Expiration vulnerability in Apache Answer.

This issue affects Apache Answer: through 2.0.1.

Administrative API keys remained usable after the owning administrator was demoted or the account was marked inactive, suspended, or deleted, allowing continued access until the keys were explicitly removed. Users are recommended to upgrade to version 2.0.2, which fixes the issue.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-613

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Answer	<= 2.0.1

References

https://lists.apache.org/thread/2vkcj3bdvso6cywnklt2vtkc2m4o0b5cMailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/08/05/14Mailing List, Third Party Advisory

Timeline

Published: Aug 5, 2026
Last modified: Oct 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-600594.8Use of uninitialized resource in the MigTD memory for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an CVE-2026-60066.3A vulnerability has been found in code-projects Patient Record Management System 1.0. The impacted element is an unknown function of the fil CVE-2026-600605.1Improper Handling of Length Parameter Inconsistency (CWE-130) vulnerability exists in TTSSH2 plugin of Tera Term provided by TeraTerm Projec CVE-2026-600626.4The NGINX Agent config_dirs directive allows a low-privileged attacker to gain limited read and write access to files outside of the designa CVE-2026-600637.0An out-of-bounds write vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption via a crafted IO CVE-2026-600655.3When NGINX Plus is configured to use the Message Queuing Telemetry Transport (MQTT) filter module (ngx_stream_mqtt_filter_module), unauthent CVE-2026-60076.3A vulnerability was found in itsourcecode Construction Management System 1.0. This affects an unknown function of the file /del.php. The man CVE-2026-600716.7Improper validation of specified quantity in input in the MigTD vsock packet handling for the Intel(R) TDX Migration Trust Domain (MigTD) wi CVE-2026-600735.9An out-of-bounds read in the Productivity Suite allows a physical attacker to control the length of data sent to a USB device. This can le CVE-2026-600747.5Date::Manip versions through 7.00 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check. CVE-2026-600757.5Date::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_tim CVE-2026-60086.8Authorization bypass through User-Controlled key vulnerability in Im Park Information Technology, Electronics, Press, Publishing and Adverti