CVE-2026-59074: Improper Cryptographic Signature Verification in Edito CMS
Edito CMS is vulnerable to improper cryptographic signature verification in the JWT refresh logic. An authenticated low-privilege user can submit self-crafted JWT containing an existing user identifier and, due to the lack of signature validation, obtain a valid, fully-signed session token for any account in the system. This allows the attacker to impersonate any user, including administrators. This issue was fixed in version 5.10.2607. Hotfixes for older versions (5.8) have also been released.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Edito CMSto a version that resolves this vulnerability.Fixed in 5.10.2607
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated low-privilege Edito CMS user can exploit it. The attacker does not need administrator privileges or user interaction.
What access can an attacker obtain?
An attacker can obtain a valid, fully signed session token for any account whose existing user identifier they use in a crafted JWT. This includes administrator accounts, allowing full account impersonation.
Are older deployments covered by a remediation option?
The issue is fixed in Edito CMS version 5.10.2607. Hotfixes have also been released for version 5.8.