PT-2026-6199 · Unknown · Open Eclass

Stolichnayer · Published 2026-02-03 · Updated 2026-02-10 · CVE-2026-24667

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Open eClass versions prior to 4.2

Description The Open eClass platform, previously known as GUnet eClass, is a course management system. A flaw exists where active user sessions are not invalidated after a password change. This allows existing session tokens to remain valid, potentially granting unauthorized continued access to user accounts.

Recommendations Update to version 4.2 or later.

Exploit

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2026-24667

GHSA-5H73-53MH-M224

Affected Products

Open Eclass

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24667.json · Exploit
• https://github.com/gunet/openeclass/security/advisories/GHSA-5h73-53mh-m224 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24667 · Security Note
• https://osv.dev/vulnerability/CVE-2026-24667 · Vendor Advisory
• https://t.me/CVEtracker/43632 · Telegram Post
• https://t.me/cveNotify/151612 · Telegram Post