CVE-2026-86589CWE-303

CVE-2026-86589

published October 19, 2026

CVSS
—
EPSS
0%
Percentile
19.1
In the wild
Unconfirmed
What it is

Incorrect implementation of authentication algorithm vulnerability in Apache Answer.

This issue affects Apache Answer: through 2.0.2.

A flaw in the User Center login integration can cause a newly created external user session to omit its external identity, allowing subsequent requests to bypass central account suspension or deletion checks until the session

expires or is revoked.

Users are recommended to upgrade to version 2.0.3, which fixes the issue.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00277 · 19.1th percentile
Weakness
CWE-303 · Incorrect Implementation of Authentication Algorithm
Published
2026-10-19T14:16Z
References (2)
https://lists.apache.org/thread/t8mbzfolzlqz4z5hcwq3v0lnwjqb2tl5 · [email protected]http://www.openwall.com/lists/oss-security/2026/10/16/33 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 21 OCT 03:32Z
    EPSS moved — → 0%
    epss
  • 19 OCT 09:35Z
    Apache Answer: User Center integration does not revoke first-login sessions after central account suspension
    cvelistv5
  • 19 OCT 09:35Z
    Apache Answer: User Center integration does not revoke first-login sessions after central account suspension
    cvelistv5