Executive brief
admin3 is a lightweight backend management framework for user and permission administration. When an administrator disables a user account, the system fails to invalidate existing sessions, allowing an attacker with a previously-issued authentication token to continue accessing the system with full original permissions. This undermines account lockout controls and creates a window of unauthorized access even after administrators believe they have revoked user credentials.
Technical details
The vulnerability is a session invalidation bypass in the UserService.disableUser() method, which sets the user state to LOCKED but does not revoke or invalidate active bearer tokens. The AuthInterceptor only validates token existence, not the user's current locked status or session freshness, and session expiry resets on each request. An attacker who obtained a bearer token before account disablement can continue authenticating successfully by replaying the token in the Authorization header. The attack requires prior network access to capture or obtain the target user's bearer token (typically through phishing or account compromise), but then persists even after the account is administratively locked. Patches should force token re-validation against current user state on each request.
Affected products
- <UNKNOWN> admin3 through 3.0.0
Timeline
- 2026-09-17: disclosed
- other: CVE-2026-92920 assigned