CVE-2026-92918: admin3 through 3.0.0 Session Token Disclosure via Audit Log
admin3 through 3.0.0 persists user session tokens in the audit log event body when publishing UserLoggedIn domain events. Attackers with log:view permission can read the JSON response from the GET /logs endpoint to harvest session tokens and replay them as bearer credentials for full user access.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an account or other access that grants the log:view permission. They can retrieve audit log data from the GET /logs endpoint and extract session tokens from UserLoggedIn event bodies.
What level of access can a stolen token provide?
The disclosed session tokens can be replayed as bearer credentials for full access as the user whose token was harvested.
How can I determine whether tokens may already have been exposed?
Review access to the GET /logs endpoint by principals with log:view permission and inspect audit log entries for UserLoggedIn events whose JSON bodies contain session tokens. Any such tokens should be treated as compromised because authorized log viewers could have read them.