Executive brief
admin3 is a lightweight admin framework written in Java and Spring Boot. A vulnerability causes user session tokens to be stored unprotected in audit logs. Any user with log-viewing permission can access these tokens and replay them to impersonate other users, potentially gaining unauthorized administrative access to the system.
Technical details
The vulnerability is an information disclosure flaw in the audit logging subsystem. When admin3 publishes UserLoggedIn domain events, it persists the full UserinfoDTO—including active session tokens—in the audit log event body. The GET /logs endpoint returns these events as raw JSON in the eventBody field, accessible to any user holding the log:view permission. An attacker can harvest valid session tokens from the logs and replay them as Bearer credentials in the Authorization header, bypassing authentication and assuming the privileges of the victim user. No authentication or special network access is required beyond the log:view permission.
Affected products
- admin3 admin3 through 3.0.0
Timeline
- 2026-09-17: disclosed