CVE-2026-60053

Insufficient Session Expiration vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Administrative API keys remained usable after the owning administrator was demoted or the account was marked inactive, suspended, or deleted, allowing continued access until the keys were explicitly removed. Users are recommended to upgrade to version 2.0.2, which fixes the issue.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/2vkcj3bdvso6cywnklt2vtkc2m4o0b5c	Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/08/05/14	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:answer:*:*:*:*:*:*:*:*

History

23 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Vulnerabilidad de expiración de sesión insuficiente en Apache Answer. Este problema afecta a Apache Answer: hasta la versión 2.0.1. Las claves de API administrativas permanecieron utilizables después de que el administrador propietario fuera degradado o la cuenta fuera marcada como inactiva, suspendida o eliminada, permitiendo el acceso continuado hasta que las claves fueran eliminadas explícitamente. Se recomienda a los usuarios actualizar a la versión 2.0.2, que soluciona el problema.

Information

Published : 2026-08-05 16:16

Updated : 2026-10-24 16:10

NVD link : CVE-2026-60053

Mitre link : CVE-2026-60053

CVE.ORG link : CVE-2026-60053

JSON object : View

Products Affected

apache

answer

CWE

CWE-613

Insufficient Session Expiration

{"id": "CVE-2026-60053", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-60053", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-06T17:47:10.305652Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache Answer", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.0.1"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-05T16:16:58.323", "references": [{"url": "https://lists.apache.org/thread/2vkcj3bdvso6cywnklt2vtkc2m4o0b5c", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/08/05/14", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-613"}]}], "descriptions": [{"lang": "en", "value": "Insufficient Session Expiration vulnerability in Apache Answer.\n\nThis issue affects Apache Answer: through 2.0.1.\n\nAdministrative API keys remained usable after the owning administrator was demoted or the account was marked inactive, suspended, or deleted, allowing continued access until the keys were explicitly removed.\nUsers are recommended to upgrade to version 2.0.2, which fixes the issue."}, {"lang": "es", "value": "Vulnerabilidad de expiraci\u00f3n de sesi\u00f3n insuficiente en Apache Answer.\n\nEste problema afecta a Apache Answer: hasta la versi\u00f3n 2.0.1.\n\nLas claves de API administrativas permanecieron utilizables despu\u00e9s de que el administrador propietario fuera degradado o la cuenta fuera marcada como inactiva, suspendida o eliminada, permitiendo el acceso continuado hasta que las claves fueran eliminadas expl\u00edcitamente.\nSe recomienda a los usuarios actualizar a la versi\u00f3n 2.0.2, que soluciona el problema."}], "lastModified": "2026-10-24T16:10:00.153", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:answer:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5584F84D-4A07-42B6-8380-4DBD2C81D87B", "versionEndExcluding": "2.0.2"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}