← Back

CVE-2026-24667

nvd nist
Published: Feb 3, 2026Modified: Jun 17, 2026

JSON object

Loading...
5.0
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
Exploitability: 1.6 / Impact: 3.4
Source: security-advisories@github.com (Secondary)

Description

The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, failure to invalidate active user sessions after a password change allows existing session tokens to remain valid, potentially enabling unauthorized continued access to user accounts. This issue has been patched in version 4.2.

Affected (1)

Gunet
1 product
Open Eclass Platform
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Open Eclass Platform
Before 4.2

Related CWEs

CWE-613
Insufficient Session Expiration
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

References (1)

Source: security-advisories@github.com
Vendor Advisory

Timeline

No history available yet.