CVE-2026-86589
Apache Answer: User Center integration does not revoke first-login sessions after central account suspension
- State
- Published
- Severity
- 5.4 Medium
- Published
- Oct 19, 2026
- Updated
- Oct 30, 2026
- Reserved
- Sep 8, 2026
Description
Incorrect implementation of authentication algorithm vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.2.
A flaw in the User Center login integration can cause a newly created external user session to omit its external identity, allowing subsequent requests to bypass central account suspension or deletion checks until the session expires or is revoked.
Users are recommended to upgrade to version 2.0.3, which fixes the issue.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.4 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N | CISA-ADP |
Weaknesses
- CWE-303 Incorrect implementation of authentication algorithm
Affected Products
| Product | Versions |
|---|---|
Apache AnswerApache Software Foundation |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.