Threats tagged 'ghsa-v3wh-4qp2-g2hm'

REDAXO core versions from 5.3.0 up to but not including 5.21.4 contain an authentication bypass vulnerability in the structure/history plugin. This flaw allows unauthenticated attackers to forge temporary login tokens by forcing the session-tied secret into a predictable state. Exploitation can lead to unauthorized backend access, including admin-level privileges, and code execution outside of live mode.