CVE-2026-96616
Medium · 6.5CVSS
6.5
EPSS
0.4%
Published
Oct 22, 2026
CISA due date
—
The record
Authentication tokens issued by the E3's web management interface on login are given an expiration time far beyond any reasonable session lifetime, effectively making them non-expiring. A token obtained through interception or device compromise remains valid for authenticated access for an extended period.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-63400 Coop is an open source review and moderation tool from ROOST. CWE-613
- CVE-2026-116251 pgAdmin 4 did not invalidate a user's existing sessions when their password changed… CWE-613
- CVE-2026-119577 ArcadeDB before 26.10.2 contains an improper authorization vulnerability that allows… CWE-613
- CVE-2026-118665 GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. CWE-613
- CVE-2026-6647 In deployments of WSO2 Identity Server configured with a case-insensitive user store and… CWE-613
- CVE-2026-3583 When the `allowed_scopes` configuration is enabled, the OAuth2 token introspection… CWE-613
- CVE-2026-117499 @fastify/session is a session plugin for Fastify. CWE-613
- CVE-2026-116894 REDAXO before 5.21.5 contains an insufficient session expiration vulnerability that… CWE-613