CVE-2026-84155
MEDIUM
MEDIUM
Priority: 0.01
BB Relevance:
26/100
Published: 2026-11-06
Modified: 2026-11-12
First seen: 2026-11-06
Status: active
Attack Surface
Low Complexity
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Local
AC:
Low
PR:
Low
UI:
Passive
S:
X
AT:
Present
VC:
High
VI:
High
VA:
None
Description
CodeChecker's web server fails to fully invalidate a session token on logout when the server runs with more than one API worker process (the default). Each worker process maintains its own in-memory session cache; logout only clears the cache of the single worker that handles the request (plus the shared database record). Other workers continue to honor the destroyed token from their stale in-memory copies until the session's lifetime expires. An attacker who has captured a valid token can therefore keep impersonating the user after the user has logged out.
Weakness Classification (1)
Affected Software (2)
| Vendor | Product | Version |
|---|---|---|
| Ericsson | CodeChecker | 0 < 6.29.3 |
| Ericsson | CodeChecker | 0 < 6.29.3 |