CVE-2026-46657: Bludit's persistent authentication tokens not revoked upon account disablement
Bludit is a content management system. Versions prior to 3.22.0 have a vulnerability in the user management logic that allows deactivated accounts to maintain access via persistent authentication tokens. When an administrator disables a user account, the application fails to invalidate or clear the associated tokenAuth and tokenRemember fields in the JSON database. Consequently, any user with a pre-existing "Remember Me" cookie can bypass the account disablement and maintain a valid authenticated state. Version 3.22.0 patches the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Bluditto a version that resolves this vulnerability.Fixed in 3.22.0 - Operational
For any disabled user accounts, manually clear the tokenAuth and tokenRemember fields in Bludit's JSON database to revoke persistent authentication tokens and force logout. In addition, expire or remove any existing "Remember Me" cookies for affected users so previously issued cookies cannot be used to authenticate until the application is patched.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46657?
The severity of CVE-2026-46657 is classified as high with a score of 7.1.
How do I fix CVE-2026-46657?
To fix CVE-2026-46657, upgrade Bludit to version 3.22.0 or later.
What vulnerability does CVE-2026-46657 describe?
CVE-2026-46657 describes a flaw in Bludit that allows deactivated accounts to retain access through persistent authentication tokens.
Which versions of Bludit are affected by CVE-2026-46657?
Bludit versions prior to 3.22.0 are affected by CVE-2026-46657.
What is the risk associated with CVE-2026-46657?
The risk associated with CVE-2026-46657 is rated at 48, which indicates significant potential for unauthorized access.