cjbi CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM cjbi CVE published 2026-09-17

CVE-2026-92920

CVE-2026-92920 debrief: The admin3 library through version 3.0.0 fails to properly invalidate existing sessions when a user account is disabled. This allows attackers who have obtained a bearer token prior to the account being disabled to continue using that token to authenticate requests. The AuthInterceptor does not re-validate the user's locked status, and session expiry resets on each request, enablin [truncated]