Intel

CVE-2026-60053

answer: Insufficient Session Expiration (CVE-2026-60053)

criticalEPSS 0.6%

Affected

  • apache/answer lt *..2.0.2

Description

Insufficient Session Expiration vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Administrative API keys remained usable after the owning administrator was demoted or the account was marked inactive, suspended, or deleted, allowing continued access until the keys were explicitly removed. Users are recommended to upgrade to version 2.0.2, which fixes the issue.

Source: NVD (NIST)cvelistv5

Affected products

The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

apacheanswer
2.0.2fixed from 2.0.2

Metrics

XIEM Effective CVSS
9.1
Source: cna-v3
EPSS percentile
45.3 %
High — this CVE ranks above the median of all CVEs scored today (rank ≥ 36%).
KEV status
—
Show all metrics
Severity
critical
Priority score
86.18
Exploit maturity
no public PoC known
CVSS v3
9.1
EPSS score
0.6 %
Low — model estimates < 1% exploitation likelihood.
Published
2026-08-05 15:13 UTC
CWE
CWE-613

Weakness classes (CWE)

  • CWE-613Base

    Insufficient Session Expiration

    According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

    cwe.mitre.org →

References & sources

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

  1. CVE Modified2026-08-06 22:18 UTC· 134c704f-9b21-4f2e-91b3-4a467353bcc0
    • CVSS V3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    • SSVC: {"id":"CVE-2026-60053","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"yes"},{"technical…
  2. New CVE Received2026-08-05 16:16 UTC· security@apache.org
    • Affected: Apache Answer
    • Description: Insufficient Session Expiration vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Administrative API keys remained usable after the owning administrator was demoted or the account was marked inactive, suspended, or deleted, allowing continued access until the keys were explicitly removed. Users are recommended to upgrade to version 2.0.2, which fixes the issue.
    • CWE: CWE-613
    • Reference: https://lists.apache.org/thread/2vkcj3bdvso6cywnklt2vtkc2m4o0b5c

Linked advisories