CVE-2026-86589: Apache Answer: User Center integration does not revoke first-login sessions after central account suspension
Apache Answer User Center sessions can ignore central account suspension or deletion until they expire.
CVE-2026-86589 is a moderate authentication-implementation flaw in Apache Answer through 2.0.2. A newly created external user session from the User Center integration can omit its external identity, so later requests skip central account suspension or deletion checks until the session ends. Apache recommends upgrading to 2.0.3. Exploitation is not reported.
- CVE-2026-86589 affects Apache Answer through 2.0.2.
- First-login User Center sessions can omit the external identity.
- Suspended or deleted central accounts may keep bypassing checks until the session ends.
- Upgrade to 2.0.3; Apache rates the issue moderate.
- CVEs
- CVE-2026-86589
- Vendors
- Apache
- Products
- Apache Answer
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-86589 | Incorrect implementation of authentication algorithm vulnerability in Apache Answer | 5.4 | — |
From the original article
Posted by Enxin Xie on Oct 15 Severity: moderate Affected versions: - Apache Answer through 2. 0. 2 Description: Incorrect implementation of authentication algorithm vulnerability in Apache Answer.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.