katalyst CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH katalyst CVE published 2026-05-14

CVE-2026-44511

CVE-2026-44511 debrief: Katalyst Koi admin session cookies were not properly invalidated upon logout, allowing continued access to admin functionality with valid session cookies until expiration or session secret rotation. This issue impacts Katalyst Koi deployments, requiring prompt patching to versions 4.20.0 or 5.6.0 and session secret rotation to prevent unauthorized admin access. The vulnerability is [truncated]