CVE-2026-117532
REDAXO Core 5.3.0 before 5.21.4 Authentication Bypass via History Plugin
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Fix
- Fixed in 5.21.4
- Public exploit
- None on Exploit-DB
Summary
REDAXO, a PHP content management system, is affected through its history plugin, which lets unauthenticated attackers forge login tokens and gain backend access, including admin accounts. This can lead to code execution beyond the site's live mode.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in the structure/history plugin that allows unauthenticated attackers to forge temporary login tokens. Attackers can force the session-tied secret into a predictable state and forge tokens for accounts like admin, gaining backend access and code execution outside live mode.
Affected versions
- redaxo core
From 5.3.0 · fixed in 5.21.4