{"id":"CVE-2026-84155","title":"Session Token Remains Valid After Logout in Multi-Worker Deployments","summary":"CodeChecker's web server fails to fully invalidate a session token on logout when the server runs with more than one API worker process (the default). Each worker process maintains its own\nin-memory session cache; logout only clears the …","severity":"medium","cvss":5.3,"cvssVector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","cvssSource":"cna","cwe":["CWE-613"],"vendor":"Ericsson","product":"CodeChecker","affected":["CodeChecker < 6.29.3"],"published":"2026-11-06","updated":"2026-11-06","sourceUpdated":"2026-11-06T10:27:24.656Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-84155","references":[{"url":"https://github.com/Ericsson/codechecker/security/advisories/GHSA-r42x-9wgw-cqc2"}],"tags":["cve.org"],"ingestedAt":"2026-11-06T10:49:35.379Z","epss":0.00139,"epssPercentile":0.03327,"slug":"CVE-2026-84155","body":"## Overview\n\nCodeChecker's web server fails to fully invalidate a session token on logout when the server runs with more than one API worker process (the default). Each worker process maintains its own\nin-memory session cache; logout only clears the cache of the single worker that handles the request (plus the shared database record). Other workers continue to honor the destroyed token\nfrom their stale in-memory copies until the session's lifetime expires. An attacker who has captured a valid token can therefore keep impersonating the user after the user has logged out.\n\n## Affected\n\n- `CodeChecker < 6.29.3`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}