CVE-2026-117532

Summary

The REDAXO core structure/history plugin before version 5.21.4 contains a CWE-287 authentication bypass flaw that allows unauthenticated attackers to forge temporary login tokens by forcing the session-tied secret into a predictable state, enabling full backend access and code execution outside live mode.

Exploitability

Exploitation is straightforward for remote attackers as it requires no authentication, minimal user interaction, and leverages predictable token generation logic in the affected plugin versions.

Blast radius

Successful exploitation grants unauthenticated remote attackers full administrative control over the REDAXO backend, enabling complete compromise of confidentiality, integrity, and availability including arbitrary code execution.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to REDAXO core version 5.21.4 or later, which contains the official fix for this authentication bypass vulnerability in the structure/history plugin.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.