CVE-2026-86589: Apache Answer: User Center integration does not revoke first-login sessions after central account suspension
Incorrect implementation of authentication algorithm vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.2.
A flaw in the User Center login integration can cause a newly created external user session to omit its external identity, allowing subsequent requests to bypass central account suspension or deletion checks until the session expires or is revoked.
Users are recommended to upgrade to version 2.0.3, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Answerto a version that resolves this vulnerability.Fixed in 2.0.3
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using the User Center integration are affected. The issue concerns sessions established during a user's first login.
What happens after a central account is suspended?
A first-login session is not revoked when the corresponding central account is suspended, so that session may remain active.