CVE-2026-28275CWE-613

Initiative Vulnerable to Improper Session Invalidation (JWT Remains Valid)

High · published February 26, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
32.9
In the wild
Unconfirmed
What it is

Initiative is a self-hosted project management platform. Versions of the application prior to 0.32.4 do not invalidate previously issued JWT access tokens after a user changes their password. As a result, older tokens remain valid until expiration and can still be used to access protected API endpoints. This behavior allows continued authenticated access even after the account password has been updated. Version 0.32.4 fixes the issue.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00399 · 32.9th percentile
Weakness
CWE-613 · Insufficient Session Expiration
Published
2026-02-26T22:56Z
EPSS history
Timeline
  • 26 FEB 22:56Z
    Initiative Vulnerable to Improper Session Invalidation (JWT Remains Valid)
    cvelistv5