PT-2026-22223 · Unknown · Initiative

G3Xar · Publicado 2026-02-26 · Atualizado 2026-03-03 · CVE-2026-28275

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Initiative versions prior to 0.32.4

Description Initiative, a self-hosted project management platform, does not invalidate previously issued JWT access tokens after a user changes their password. This allows older tokens to remain valid until their expiration, enabling continued authenticated access to protected API endpoints even after a password update. The vulnerable component is related to JWT (JSON Web Token) access token handling.

Recommendations Update to version 0.32.4 or later.

Exploit

Correção

Insufficient Session Expiration

Enumeração de Fraquezas

CWE-613

Identificadores relacionados

CVE-2026-28275

GHSA-HWW6-3FWW-XW3H

Produtos afetados

Initiative

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28275.json · Exploit
• https://github.com/Morelitea/initiative/security/advisories/GHSA-hww6-3fww-xw3h · Aviso do Fabricante
• https://github.com/Morelitea/initiative/releases/tag/v0.32.4 · Nota
• https://osv.dev/vulnerability/CVE-2026-28275 · Aviso do Fabricante
• https://twitter.com/CveTodo/status/2027167074565411313 · Publicação no Twitter
• https://twitter.com/cracbot/status/2028787703723294862 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-28275 · Nota de Segurança
• https://twitter.com/pulsepatchio/status/2027755267778064693 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2027466631170166994 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2027185455360307619 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2027162044328493538 · Publicação no Twitter