CVE-2026-86589: CWE-303 Incorrect implementation of authentication algorithm in Apache Software Foundation Apache Answer

This vulnerability arises from a flaw in the User Center login integration of Apache Answer versions through 2.0.2. Specifically, when an external user session is created, it may omit the external identity attribute, which is critical for enforcing account suspension or deletion policies. As a result, attackers can bypass these central account checks during the lifetime of the session, potentially allowing unauthorized access or use of suspended or deleted accounts. The Apache Software Foundation has addressed this issue in version 2.0.3.

The impact is that suspended or deleted accounts can still be used to access the system if the session was created before the suspension or deletion, due to the missing external identity in the session. This could lead to unauthorized access or actions by users who should no longer have valid credentials until the session naturally expires or is revoked.

Users are recommended to upgrade Apache Answer to version 2.0.3, which contains the official fix for this vulnerability. No other mitigation steps are indicated by the vendor advisory.