CVE-2026-74037: Insufficient Session Expiration in Wazuh wazuh-manager

Wazuh wazuh-manager versions >=4.0.0 and <4.14.8 contain a vulnerability where the check_token function fails to consult the blacklist for tokens issued to run_as users with zero static roles. As a result, tokens for revoked administrator users remain valid, enabling continued authentication and privilege escalation by self-linking the administrator role. This is due to insufficient session expiration and token invalidation mechanisms.

Attackers who had administrator privileges that were revoked can still authenticate using previously issued tokens. They can permanently retain privileged access by linking themselves to the administrator role, bypassing intended access revocation controls. This undermines the security of the system by allowing unauthorized persistent administrative access.

A fix is available in Wazuh version 4.14.8 and later. Users should upgrade to version 4.14.8 or newer to ensure tokens are properly invalidated and revoked administrator privileges cannot be abused. No other mitigation guidance is provided in the input data.