CVE-2026-86589

Not scored yetLast modified Oct 19, 2026

Description

Incorrect implementation of authentication algorithm vulnerability in Apache Answer.

This issue affects Apache Answer: through 2.0.2.

A flaw in the User Center login integration can cause a newly created external user session to omit its external identity, allowing subsequent requests to bypass central account suspension or deletion checks until the session expires or is revoked.

Users are recommended to upgrade to version 2.0.3, which fixes the issue.

Metrics

No CVSS score has been published yet.

Weakness enumeration

CWE-303

Affected software

No affected versions have been published.

Timeline

Published
Oct 19, 2026
Last modified
Oct 19, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-86598.8OS Command Injection vulnerability in Rapid7 InsightConnect SQLmap Plugin on Linux allows authenticated attackers to execute arbitrary OS coCVE-2026-865906.3In Eclipse Che versions 7.79.0 through 7.121.0, the dashboard backend's POST /dashboard/api/data/resolver endpoint passes a caller-supplied CVE-2026-865919.8The Botiga Pro WordPress plugin before 1.6.5 does not perform any authorisation checks on one of its REST routes, allowing unauthenticated uCVE-2026-865958.8Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Iron Mountain Archiving Services Inc. CVE-2026-865976.5Insertion of sensitive information into log files in the Snowflake Python, Go, JDBC, Node.js, PHP PDO, and ODBC drivers allowed authenticatiCVE-2026-86609.8OS Command Injection vulnerability in the ping action of Rapid7 InsightConnect Ping Plugin on Linux allows remote attackers to execute arbitCVE-2026-866008.2In affected Snowflake drivers, WORKLOAD_IDENTITY authentication requests a cloud workload-identity token and attaches it to the login requesCVE-2026-866016.5The WP Recipe Maker WordPress plugin before 10.8.2 does not remove shortcodes from comment content before expanding it while building a pageCVE-2026-866024.3The WP Recipe Maker WordPress plugin before 10.8.2 does not perform any capability check in one of its AJAX actions, allowing any authenticaCVE-2026-866034.3The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its AJAX actions, allowing any authenticaCVE-2026-866044.8The GTranslate WordPress plugin before 5.0.1 does not remove shortcodes from the content of outgoing emails before expanding them which, in CVE-2026-866074.3Internal Application Information Exposure Vulnerability in Hitachi Ops Center Administrator. This issue affects Hitachi Ops Center Adminis
CVE-2026-86589: Unscored | Vulnix