---
id: CVE-2026-50000
title: 'SecureDrop: API session token reuse against the Journalist Interface web UI'
summary: >-
  SecureDrop is an open-source whistleblower submission system that media
  organizations can use to securely accept documents from, and communicate with
  anonymous sources. From 2.5.0 until 2.16.0, the `Journalist Interface` can
  accept an `A…
severity: medium
cvss: 5
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-863
vendor: freedomofpress
product: securedrop
affected:
  - 'securedrop >= 2.5.0, < 2.16.0'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-30T18:25:18.367118Z'
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T18:35:34.990Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-50000'
references:
  - url: >-
      https://github.com/freedomofpress/securedrop/security/advisories/GHSA-78xq-8jf3-gpfx
    label: >-
      https://github.com/freedomofpress/securedrop/security/advisories/GHSA-78xq-8jf3-gpfx
  - url: >-
      https://github.com/freedomofpress/securedrop/commit/cbe60cd68b67f44ffdd44c364c71cc71b40acfb5
    label: >-
      https://github.com/freedomofpress/securedrop/commit/cbe60cd68b67f44ffdd44c364c71cc71b40acfb5
  - url: 'https://github.com/freedomofpress/securedrop/releases/tag/2.16.0'
    label: 'https://github.com/freedomofpress/securedrop/releases/tag/2.16.0'
tags:
  - cve.org
epss: 0.00359
epssPercentile: 0.29847
ingestedAt: '2026-11-05T16:24:31.331Z'
---

## Overview

SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communicate with anonymous sources. From 2.5.0 until 2.16.0, the `Journalist Interface` can accept an `API session` token against the `web UI` because its `SessionInterface` keeps a mutable session key prefix that changes with each request and persists across requests. API and web sessions were separated in `Redis` starting in version 2.5.0, but prefix corruption confuses those session namespaces. An attacker who already has access to the secret `Journalist Interface` onion address, the required authentication access and a recent nonexpired `API session` token can reuse that token against the `web UI` until its natural expiry, at most eight hours. The corrupted prefix can also prevent logout from deleting the correct `Redis` session, although normal expiry still applies. A compromised journalist can access encrypted submissions and perform broad actions on source submissions, but this issue does not expose plaintext submissions or affect the running system's availability. This issue is fixed in version 2.16.0.

## Affected

- `securedrop >= 2.5.0, < 2.16.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.