Edito CMS contains a vulnerability in its JWT refresh logic where cryptographic signature verification is improperly performed. This flaw allows an authenticated low-privilege user to craft a JWT with an existing user identifier and bypass signature validation to obtain a valid session token for any user account, including administrators. The vulnerability is fixed in version 5.10.2607, with hotfixes available for older 5.8 versions.