CVE-2026-86589None▾ SunlitIncorrect implementation of authentication algorithm vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. A flaw in the User Center login integration can cause a newly created external user session to om…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Incorrect implementation of authentication algorithm vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.2.
A flaw in the User Center login integration can cause a newly created external user session to omit its external identity, allowing subsequent requests to bypass central account suspension or deletion checks until the session expires or is revoked.
Users are recommended to upgrade to version 2.0.3, which fixes the issue.
apache_answer <= 2.0.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-67249NoneApache Answer: Email Code Purpose Confusion May Allow Account Takeover
CVE-2026-64943NoneApache Answer: API keys logged in plaintext during authentication
CVE-2026-64945NoneApache Answer: Incorrect permission mapping allows users with only the unpin permission to hide/show questions
CVE-2026-64944NoneApache Answer: Stored XSS via unsanitized HTML in imported question content
CVE-2026-79624NoneApache Answer: Stale Visit Tokens Retain Access to Private Uploads After Session Revocation
CVE-2026-71563NoneApache Answer: MCP Answer Retrieval Exposes Content from Non-Public Questions