CVE-2026-60053

CriticalCVSS 9.1/10Last modified Oct 24, 2026

Description

Insufficient Session Expiration vulnerability in Apache Answer.

This issue affects Apache Answer: through 2.0.1.

Administrative API keys remained usable after the owning administrator was demoted or the account was marked inactive, suspended, or deleted, allowing continued access until the keys were explicitly removed. Users are recommended to upgrade to version 2.0.2, which fixes the issue.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-613

Affected software

No affected versions have been published.

Timeline

Published: Aug 5, 2026
Last modified: Oct 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-60066.3A vulnerability has been found in code-projects Patient Record Management System 1.0. The impacted element is an unknown function of the fil CVE-2026-600605.1Improper Handling of Length Parameter Inconsistency (CWE-130) vulnerability exists in TTSSH2 plugin of Tera Term provided by TeraTerm Projec CVE-2026-600626.4The NGINX Agent config_dirs directive allows a low-privileged attacker to gain limited read and write access to files outside of the designa CVE-2026-600637.0An out-of-bounds write vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption via a crafted IO CVE-2026-600655.3When NGINX Plus is configured to use the Message Queuing Telemetry Transport (MQTT) filter module (ngx_stream_mqtt_filter_module), unauthent CVE-2026-60076.3A vulnerability was found in itsourcecode Construction Management System 1.0. This affects an unknown function of the file /del.php. The man CVE-2026-600735.9An out-of-bounds read in the Productivity Suite allows a physical attacker to control the length of data sent to a USB device. This can le CVE-2026-600747.5Date::Manip versions through 7.00 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check. CVE-2026-600757.5Date::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_tim CVE-2026-60086.8Authorization bypass through User-Controlled key vulnerability in Im Park Information Technology, Electronics, Press, Publishing and Adverti CVE-2026-600807.3Use After Free vulnerability in the Rust deserialization logic of Apache Fory. This issue affects Apache Fory from 0.13.0 through 1.3.0. A CVE-2026-600817.5DBI::ProfileData versions before 1.651 for Perl do not limit the path index. The path index column of profile dump files is used to allocat