CVE-2026-105690

5.9 MEDIUMpublic exploit available

Published 2026-10-05 · Updated 2026-10-05

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, logout clears the browser's auth-token cookie without revoking the corresponding server-side session. A previously captured session token remains usable after the victim logs out and can continue to make authenticated requests with the victim's authority until natural expiration. This issue is fixed in version 2.18.0.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N

Weaknesses

CWE-613

Public exploit & PoC references

https://github.com/penpot/penpot/commit/7c85837290c4e7d6f7d99472b092ad4f7c9d6a97
https://github.com/penpot/penpot/releases/tag/2.18.0
https://github.com/penpot/penpot/security/advisories/GHSA-mj9f-5cwq-7p3q

All references

https://github.com/penpot/penpot/commit/7c85837290c4e7d6f7d99472b092ad4f7c9d6a97
https://github.com/penpot/penpot/releases/tag/2.18.0
https://github.com/penpot/penpot/security/advisories/GHSA-mj9f-5cwq-7p3q

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2024-8122
MEDIUMCVE-2025-71435PoC
MEDIUMCVE-2026-100502PoC
MEDIUMCVE-2026-100554PoC
MEDIUMCVE-2026-100624PoC
HIGHCVE-2026-100711PoC
UNSCOREDCVE-2026-101271
MEDIUMCVE-2026-102367PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.