Incorrect Implementation of Authentication Algorithm in Apache Answer - CVE-2026-86589
Published: October 23, 2026
Vulnerability identifier: #VU157278
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-86589
CWE-ID: CWE-303
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to bypass central account suspension or deletion checks and retain access through an existing session.
The vulnerability exists due to incorrect implementation of an authentication algorithm in the User Center login integration when creating an external user's first-login session without its external identity. A remote user can continue making requests with the affected session after central account suspension or deletion to retain access until the session expires or is revoked.
Affected software
Apache Answer
How to mitigate CVE-2026-86589
Install security update from vendor's website.
Apache Answer - update to 2.0.3