CVE-2026-1435

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-1435

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-1435.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-1435

Published

2026-02-18T13:08:36Z

Modified

2026-08-12T03:51:41Z

Severity

9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Incorrect management of session invalidation vulnerability in Graylog Web Interface

Details

Not properly invalidated session vulnerability in Graylog Web Interface, version 2.2.3, due to incorrect management of session invalidation after new logins. The application generates a new 'sessionId' each time a user authenticates, but does not invalidate previously issued session identifiers, which remain valid even after multiple consecutive logins by the same user. As a result, a stolen or leaked 'sessionId' can continue to be used to authenticate valid requests. Exploiting this vulnerability would allow an attacker with access to the web service/API network (port 9000 or HTTP/S endpoint of the server) to reuse an old session token to gain unauthorized access to the application, interact with the API/web, and compromise the integrity of the affected account.

Database specific

{
    "cna_assigner": "INCIBE",
    "cwe_ids": [
        "CWE-613"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/1xxx/CVE-2026-1435.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "2.2.3"
                },
                {
                    "last_affected": "2.2.3"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/graylog2/graylog2-server

Affected ranges

Type

GIT

Repo

https://github.com/graylog2/graylog2-server

Events

Introduced

7adc951e40b9dcacc3bc60d2b51e8a5e976ca53b

Last Affected

7adc951e40b9dcacc3bc60d2b51e8a5e976ca53b

Database specific

Show details

{
    "cpe": "cpe:2.3:a:graylog:graylog:2.2.3:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "2.2.3"
        },
        {
            "last_affected": "2.2.3"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

2.*

2.2.3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-1435.json"