Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in the structure/history plugin that allows unauthenticated attackers to forge temporary login tokens. Attackers can force the session-tied secret into a predictable state and forge tokens for accounts like admin, gaining backend access and code execution outside live mode.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
#schwachstellen REDAXO: Kritische Authentifizierungsumgehung in Core vor 5.21.4 ermöglicht Admin-Zugriff #cms #cve2026117532 #redaxo #webanwendungen https://cybersecurity-news.de/redaxo-cve-2026-117532-authentifizierungsumgehung-core-5-21-4
🚨 REDAXO CMS auth bypass: CVE-2026-117532, CVSS 3.1 9.8 (VulnCheck) 🔓 Unauthenticated attackers can forge login tokens, even for admin ⚠️ Only if the history plugin is active (off by default) ✅ Fixed: 5.21.4 🔗 https://github.com/redaxo/core/security/advisories/GHSA-px8f-whj8-hrpq #AppSec #PHP https://t.co/jX3b5NIpRm
🔴 REDAXO core, Authentication Bypass, #CVE-2026-117532 (critical) -DC-Oct2026-3830 https://dailycve.com/redaxo-core-authentication-bypass-cve-2026-117532-critical-dc-oct2026-3830/