REDAXO Core: Authentication bypass vulnerability (CVE-2026-117532)
REDAXO core versions 5.3.0 through 5.21.3 contain an authentication bypass vulnerability in the structure/history plugin that allows unauthenticated attackers to forge administrative login tokens and achieve code execution.
CVE search metadata
CVE search record: CVE-2026-117532. Severity: critical. CVSS: 9.8. KEV: no. Product: REDAXO core (< 5.21.4). Brief: REDAXO Core: Authentication bypass vulnerability (CVE-2026-117532). Brief link: https://feed.craftedsignal.io/briefs/2026-10-redaxo-auth-bypass/
Triage facts
Revision 1- Applicability
- REDAXO core (< 5.21.4)
- Evidence
- Unknown
- Severity
- Critical
- Action
- Immediate escalation
- Sources
- 1 public source
- Freshness
- Revision 1Oct 27, 11:46 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in the structure/history plugin. The vulnerability allows unauthenticated attackers to manipulate the session-tied secret into a predictable state, facilitating the forgery of administrative login tokens. Successful exploitation grants attackers unauthorized backend access and the ability to achieve code execution.
Impact
Successful exploitation results in full unauthorized backend access and subsequent code execution.
Recommendation
- Upgrade to REDAXO version 5.21.4 or later immediately to patch CVE-2026-117532.
- Audit web server access logs for anomalous requests directed at the 'structure/history' plugin endpoint that result in successful logins.
- Monitor for unexpected administrative logins originating from unfamiliar IP addresses.
Immediate actions
Upgrade REDAXO core to 5.21.4 or later
Threat Hunt
Identify suspicious access attempts to structure/history plugin endpoints
Data: Web server access logs
Mitigations
Upgrade REDAXO core to 5.21.4
CVE-2026-117532