CVE-2026-86589None▾ SunlitIncorrect implementation of authentication algorithm vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. A flaw in the User Center login integration can cause a newly created external user session to om…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 21.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
Incorrect implementation of authentication algorithm vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.2.
A flaw in the User Center login integration can cause a newly created external user session to omit its external identity, allowing subsequent requests to bypass central account suspension or deletion checks until the session expires or is revoked.
Users are recommended to upgrade to version 2.0.3, which fixes the issue.
apache_answer <= 2.0.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-67249Medium· 5.4Apache Answer: Email Code Purpose Confusion May Allow Account Takeover
CVE-2026-64943High· 8.1Apache Answer: API keys logged in plaintext during authentication
CVE-2026-64944NoneApache Answer: Stored XSS via unsanitized HTML in imported question content
CVE-2026-64945NoneApache Answer: Incorrect permission mapping allows users with only the unpin permission to hide/show questions
CVE-2026-68482NoneApache Answer: Improper Authorization in Question Invite User Lookup
CVE-2026-71563Medium· 4.3Apache Answer: MCP Answer Retrieval Exposes Content from Non-Public Questions