2.1
CVE-2026-101271
- EPSS 0.17%
- Veröffentlicht 29.09.2026 13:17:49
- Zuletzt bearbeitet 29.09.2026 21:28:02
- Erkennungen
OAuth credentials not disabled when application is disabled
OAuth credentials (access tokens) are valid for the entirety of their lifetime, even if the application (OAuth client) they are bound to is manually disabled.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
Herstellerpretix
≫
Produkt
pretix
Default Statusunaffected
Version
0.0
Version <
2026.5.5
Status
affected
Version
2026.6.0
Version <
2026.6.2
Status
affected
Version
2026.7.0
Version <
2026.7.1
Status
affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.17% | 0.057 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| 655498c3-6ec5-4f0b-aea6-853b334d05a6 | 2.1 | 0 | 0 |
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
|
CWE-613 Insufficient Session Expiration
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
https://pretix.eu/about/en/blog/20260929-release-2026-7-1/