CVE-2026-60053CWE-613

CVE-2026-60053

Critical · published August 5, 2026

CVSS v3.1
9.1
EPSS
1%
Percentile
46.2
In the wild
Unconfirmed
What it is

Insufficient Session Expiration vulnerability in Apache Answer.

This issue affects Apache Answer: through 2.0.1.

Administrative API keys remained usable after the owning administrator was demoted or the account was marked inactive, suspended, or deleted, allowing continued access until the keys were explicitly removed.

Users are recommended to upgrade to version 2.0.2, which fixes the issue.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00566 · 46.2th percentile
Weakness
CWE-613 · Insufficient Session Expiration
Published
2026-08-05T20:16Z
Affected products (1)
ProductVersionsFixed in
apache/answer< 2.0.22.0.2
References (2)
https://lists.apache.org/thread/2vkcj3bdvso6cywnklt2vtkc2m4o0b5c · [email protected]http://www.openwall.com/lists/oss-security/2026/08/05/14 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 05 AUG 15:13Z
    Apache Answer: Residual Administrative API Key Access After Role or Account Revocation
    cvelistv5