PT-2026-106211 · Penpot · Penpot
CVSS v3.1
5.9
Medium
| Vector | AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Penpot versions prior to 2.18.0
Description
Logout functionality clears the browser's
auth-token cookie but fails to revoke the corresponding server-side session. This allows a previously captured session token to remain valid and be used to make authenticated requests with the victim's authority until the session naturally expires.Recommendations
Update to version 2.18.0.
Fix
Insufficient Session Expiration
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Penpot