# CVE-2026-117532: REDAXO core authentication bypass in structure/history plugin

Source: https://junglewise.ai/threats/cve-2026-117532-redaxo-core-from-5-3-0-before-5-21-4-contains-an-authentication  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-27. Updated: 2026-10-27  
License: CC BY 4.0 with a link back

CVE-2026-117532 · Severity: critical · CVSS 9.8 · Published 2026-10-27

REDAXO is a content management system used to build and manage websites. The structure/history plugin contains an authentication flaw that allows attackers to forge login tokens and gain backend access without any credentials, potentially leading to full site takeover and code execution. Attackers can impersonate administrator accounts and modify all site content, user data, and execute arbitrary code on installations not in live mode.

Technologies: [REDAXO Core](https://junglewise.ai/threats/technologies/redaxo-core). Vendors: [REDAXO](https://junglewise.ai/threats/vendors/redaxo).

## Quick answers

**Is CVE-2026-117532 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-117532 being exploited in the wild.

**How severe is CVE-2026-117532?** Critical severity, with a CVSS score of 9.8, published 27 October 2026.

**Which products and versions are affected?** REDAXO Core 5.3.0 to 5.21.3.

**Is there a fix for CVE-2026-117532?** Yes: fixed in 5.21.4. Until then: Deactivate the structure/history plugin if the history viewing feature is not required, or apply the provided one-line code change to redaxo/src/addons/structure/plugins/history/boot.php (line 16) to disable the temporary login mechanism while preserving history snapshots. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-117532 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-117532?** Check whether you run REDAXO Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 5.21.4

Deactivate the structure/history plugin if the history viewing feature is not required, or apply the provided one-line code change to redaxo/src/addons/structure/plugins/history/boot.php (line 16) to disable the temporary login mechanism while preserving history snapshots.

## Technical details

The history plugin's temporary frontend login feature derives authorization tokens from a login name, timestamp, and session-tied secret, but the secret can be forced into a predictable state without prior authentication. This allows unauthenticated attackers to forge valid tokens for any known account (commonly "admin") to gain a backend session. The vulnerability has a network attack vector with no privileges required and no user interaction; exploitation enables arbitrary code execution via templates and modules on non-live installations.

## Affected products

- REDAXO core 5.3.0 to 5.21.3

## Timeline

- 2026-08-03: disclosed
- 2026-10-27: advisory

## References

- [https://github.com/redaxo/core/security/advisories/GHSA-px8f-whj8-hrpq](https://github.com/redaxo/core/security/advisories/GHSA-px8f-whj8-hrpq)
- [https://www.vulncheck.com/advisories/redaxo-core-5.3.0-before-5.21.4-authentication-bypass-via-history-plugin](https://www.vulncheck.com/advisories/redaxo-core-5.3.0-before-5.21.4-authentication-bypass-via-history-plugin)

## Related threats

- [REDAXO reflected XSS in backend packages API](https://junglewise.ai/threats/cve-2026-117538-redaxo-before-5-21-0-contains-a-reflected-cross-site-scripting)
- [REDAXO broken access control in slice operations](https://junglewise.ai/threats/cve-2026-116899-redaxo-before-5-21-4-contains-a-broken-access-control)
- [REDAXO missing authorization in structure/version and structure/history previews](https://junglewise.ai/threats/cve-2026-116897-redaxo-core-before-5-21-4-contains-a-missing-authorization)
- [REDAXO cross-site request forgery in safe mode toggle](https://junglewise.ai/threats/cve-2026-116895-redaxo-before-5-21-5-contains-a-cross-site-request-forgery)
- [REDAXO core missing authorization in package API](https://junglewise.ai/threats/cve-2026-116893-redaxo-core-before-5-21-5-contains-a-missing-authorization)