CVE-2026-117532: REDAXO Core 5.3.0 before 5.21.4 Authentication Bypass via History Plugin
REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in the structure/history plugin that allows unauthenticated attackers to forge temporary login tokens. Attackers can force the session-tied secret into a predictable state and forge tokens for accounts like admin, gaining backend access and code execution outside live mode.
Affected Software
Event History
Frequently Asked Questions
Which installations are affected?
REDAXO Core versions from 5.3.0 up to, but not including, 5.21.4 are affected. The vulnerable functionality is the structure/history plugin.
Does exploitation require an existing account or user interaction?
No. The reported attack is unauthenticated and does not require user interaction; an attacker can forge temporary login tokens after making the session-tied secret predictable.
What level of access can an attacker obtain?
An attacker can forge tokens for accounts such as admin and gain backend access. The issue can lead to code execution when the installation is outside live mode.
What should be prioritized for remediation?
Upgrade REDAXO Core to version 5.21.4 or later. Until the upgrade is complete, treat affected backend instances as exposed to unauthenticated administrative access, particularly where they are not in live mode.