PT-2026-22223 · Unknown · Initiative

G3Xar · Published 2026-02-26 · Updated 2026-03-03 · CVE-2026-28275

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Initiative versions prior to 0.32.4

Description Initiative, a self-hosted project management platform, does not invalidate previously issued JWT access tokens after a user changes their password. This allows older tokens to remain valid until their expiration, enabling continued authenticated access to protected API endpoints even after a password update. The vulnerable component is related to JWT (JSON Web Token) access token handling.

Recommendations Update to version 0.32.4 or later.

Exploit

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2026-28275

GHSA-HWW6-3FWW-XW3H

Affected Products

Initiative

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28275.json · Exploit
• https://github.com/Morelitea/initiative/security/advisories/GHSA-hww6-3fww-xw3h · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-28275 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28275 · Security Note
• https://github.com/Morelitea/initiative/releases/tag/v0.32.4 · Note
• https://twitter.com/CveTodo/status/2027167074565411313 · Twitter Post
• https://twitter.com/cracbot/status/2028787703723294862 · Twitter Post
• https://twitter.com/pulsepatchio/status/2027755267778064693 · Twitter Post
• https://twitter.com/CVEnew/status/2027466631170166994 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2027185455360307619 · Twitter Post
• https://twitter.com/TheHackerWire/status/2027162044328493538 · Twitter Post