CVE-2026-60053 is an insufficient session expiration vulnerability in Apache Answer affecting all versions before 2.0.2. Administrative API keys do not expire or become invalid when the owning administrator's account status changes to inactive, suspended, deleted, or demoted. This flaw allows those API keys to remain usable, potentially enabling unauthorized access to administrative functions until the keys are manually removed. The vulnerability is classified under CWE-613 (Insufficient Session Expiration).

The vulnerability allows continued unauthorized administrative access via API keys even after the associated administrator account is no longer active or authorized. This can lead to full compromise of administrative functions, including confidentiality and integrity impacts, but does not affect availability. The CVSS 3.1 base score is 9.1 (critical), reflecting network attack vector, low complexity, no privileges required, no user interaction, and high confidentiality and integrity impact.

Upgrade Apache Answer to version 2.0.2 or later, where this issue is fixed. Until the upgrade, explicitly revoke or remove administrative API keys associated with demoted, suspended, inactive, or deleted administrator accounts to prevent unauthorized access.