# CVE-2026-116894: REDAXO session expiration insufficient on password change

Source: https://junglewise.ai/threats/cve-2026-116894-redaxo-before-5-21-5-contains-an-insufficient-session-expiration  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-27. Updated: 2026-10-27  
License: CC BY 4.0 with a link back

CVE-2026-116894 · Severity: medium · CVSS 4.2 · Published 2026-10-27

REDAXO is a content management system used to build and manage websites. When a user changes their password, the system fails to invalidate the current session and stay-logged-in cookie, allowing an attacker who previously obtained these credentials to retain backend access for up to three months. This means even if a user changes their password after suspecting compromise, the attacker can continue to access their account.

Technologies: [REDAXO](https://junglewise.ai/threats/technologies/redaxo). Vendors: [REDAXO](https://junglewise.ai/threats/vendors/redaxo).

## Quick answers

**Is CVE-2026-116894 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116894 being exploited in the wild.

**How severe is CVE-2026-116894?** Medium severity, with a CVSS score of 4.2, published 27 October 2026.

**Which products and versions are affected?** REDAXO before 5.21.5.

**Is there a fix for CVE-2026-116894?** Yes: fixed in 5.21.5. Until then: Log out after changing your password. Logging out removes the current session including its stay-logged-in key, preventing an attacker from using the invalidated credentials.</anigation>
<parameter name="attack_vector">["network"] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-116894 attacked?** It is in a software library.

**Am I affected by CVE-2026-116894?** Check whether you run REDAXO at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 5.21.5

Log out after changing your password. Logging out removes the current session including its stay-logged-in key, preventing an attacker from using the invalidated credentials.</anigation>
<parameter name="attack_vector">["network"]

## Technical details

The vulnerability is an insufficient session expiration flaw in the password change mechanism. When a password is changed, REDAXO invalidates other sessions but fails to regenerate the current session ID or renew the stay-logged-in key in the current session. An attacker with knowledge of a user's session ID or stay-logged-in cookie can maintain backend access past the password change due to the stay-logged-in cookie's 3-month validity window. The fix regenerates the session ID and renews the stay-logged-in key upon password change.

## Affected products

- REDAXO REDAXO before 5.21.5

## Timeline

- 2026-10-06: disclosed: GHSA-mjjv-vffq-g5h6 published on GitHub Security Advisory
- 2026-10-27: patched: REDAXO 5.21.5 released with fix
- 2026-10-27: advisory: CVE-2026-116894 published on NVD

## References

- [https://github.com/redaxo/core/commit/672d22a779bfce7aa4aa445d9c831a824fb86896](https://github.com/redaxo/core/commit/672d22a779bfce7aa4aa445d9c831a824fb86896)
- [https://github.com/redaxo/core/security/advisories/GHSA-mjjv-vffq-g5h6](https://github.com/redaxo/core/security/advisories/GHSA-mjjv-vffq-g5h6)

## Related threats

- [REDAXO reflected XSS in metainfo API type parameter](https://junglewise.ai/threats/cve-2026-117537-redaxo-before-5-21-0-contains-a-reflected-cross-site-scripting)
- [REDAXO CSRF token bypass in user administration](https://junglewise.ai/threats/cve-2026-117536-redaxo-before-5-21-3-contains-a-cross-site-request-forgery)
- [REDAXO reflected cross-site scripting in media pool](https://junglewise.ai/threats/cve-2026-117535-redaxo-before-5-21-3-contains-a-reflected-cross-site-scripting)
- [REDAXO cross-site request forgery in article history plugin](https://junglewise.ai/threats/cve-2026-117534-redaxo-before-5-21-3-contains-a-cross-site-request-forgery)
- [REDAXO stored cross-site scripting in mediapool SVG uploads](https://junglewise.ai/threats/cve-2026-117533-redaxo-from-5-18-0-before-5-21-4-contains-a-stored-cross-site)