CVE-2026-73611

Name of the Vulnerable Software and Affected Versions File Browser versions 2.50.0 through 2.63.21

Description An issue exists where the software fails to validate the expiration of JSON Web Tokens (JWT)—a compact, URL-safe means of representing claims to be transferred between two parties—when proxy authentication is configured using a non-default logout page. This allows attackers possessing a previously valid token to maintain indefinite access to protected routes and administrative endpoints. Additionally, expired tokens can be exchanged for new ones through the renewal endpoint.

Recommendations Update File Browser to a version later than 2.63.21.