{"id":"CVE-2026-1435","summary":"Incorrect management of session invalidation vulnerability in Graylog Web Interface","details":"Not properly invalidated session vulnerability in Graylog Web Interface, version 2.2.3, due to incorrect management of session invalidation after new logins. The application generates a new 'sessionId' each time a user authenticates, but does not invalidate previously issued session identifiers, which remain valid even after multiple consecutive logins by the same user. As a result, a stolen or leaked 'sessionId' can continue to be used to authenticate valid requests. Exploiting this vulnerability would allow an attacker with access to the web service/API network (port 9000 or HTTP/S endpoint of the server) to reuse an old session token to gain unauthorized access to the application, interact with the API/web, and compromise the integrity of the affected account.","modified":"2026-08-12T03:51:41.947712554Z","published":"2026-02-18T13:08:36.348Z","database_specific":{"cna_assigner":"INCIBE","cwe_ids":["CWE-613"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/1xxx/CVE-2026-1435.json","unresolved_ranges":[{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"2.2.3"},{"last_affected":"2.2.3"}]}]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/1xxx/CVE-2026-1435.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1435"},{"type":"FIX","url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-graylog"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/graylog2/graylog2-server","events":[{"introduced":"7adc951e40b9dcacc3bc60d2b51e8a5e976ca53b"},{"last_affected":"7adc951e40b9dcacc3bc60d2b51e8a5e976ca53b"}],"database_specific":{"cpe":"cpe:2.3:a:graylog:graylog:2.2.3:*:*:*:*:*:*:*","extracted_events":[{"introduced":"2.2.3"},{"last_affected":"2.2.3"}],"source":"CPE_STRING"}}],"versions":["2.2.3"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-1435.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}]}