CVE-2026-92918

Name of the Vulnerable Software and Affected Versions admin3 version 3.0.0

Description User session tokens are persisted in the audit log event body during the publishing of UserLoggedIn domain events. An attacker with log:view permission can access these tokens by reading the JSON response from the 'GET /logs' endpoint. These harvested tokens can then be replayed as bearer credentials to gain full unauthorized access to user accounts.

Recommendations Update admin3 to a version newer than 3.0.0. Restrict the log:view permission to minimize the risk of session token exposure.