Insufficient Session Expiration vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Administrative API keys remained usable after the owning administrator was demoted o…

Critical CVSS 9.1

CVECVE-2026-60053

First seen2026-08-07 15:16 UTC

Disclosed2026-08-05 16:16 UTC

Last updated2026-08-07 15:16 UTC

Channel statusauto

Summary

Insufficient Session Expiration vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Administrative API keys remained usable after the owning administrator was demoted or the account was marked inactive, suspended, or deleted, allowing continued access until the keys were explicitly removed. Users are recommended to upgrade to version 2.0.2, which fixes the issue.

In-depth triage · Auto channel

No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).

Affected products

Sources

NVD DATABASE

Original Links

https://lists.apache.org/thread/2vkcj3bdvso6cywnklt2vtkc2m4o0b5c Mailing List
http://www.openwall.com/lists/oss-security/2026/08/05/14 Mailing List

Timeline

2026-08-07 nvd_ingest NVD