Critical Severity
CVE-2026-117532
Published: Nov 3, 2026
PoC for CVE-2026-117532 in REDAXO Authentication bypass, full chain not yet implemented. CVSS score 9.3 critical
# CVE-2026-117532 PoC
This repository contains a Python proof-of-concept for testing a REDAXO temporary-login validation flow associated with CVE-2026-117532.
The script logs into a REDAXO instance, extracts the CSRF token from the login page, submits the login form, identifies a usable authentication cookie, and then probes likely temporary-login validation endpoints. It then constructs a signed payload using HMAC-SHA256 over a session-derived key and a future validity timestamp, and prints the resulting validation URL and token for manual review. The full chain is not yet working due to lab issues.
## Root cause
The underlying issue is a weak temporary-login validation mechanism in REDAXO. The PoC demonstrates that a signed value based on the active session key and a `validtime` value can be created and submitted to the temporary-login endpoint. If the server trusts this signature without strong verification, replay, forgery, or validation bypass becomes possible. In effect, the authentication and authorization boundary depends on a predictable, session-derived token rather than a robust, server-side verification model.
## Impact
A valid authenticated user or attacker who can obtain a session can generate or replay a temporary-login token and potentially bypass intended access controls. This may allow unauthorized access to protected administrative functionality, impersonation of other users, or exploitation of sensitive workflows exposed through the temporary-login mechanism. In real deployments, the impact may include authentication bypass, privilege escalation, or unauthorized access to restricted application data.
This is intended for security research, reproduction, and authorized assessment work only.
## Requirements
- Python 3.9+
- `requests`
- `beautifulsoup4`
Install dependencies:
```bash
pip install requests beautifulsoup4
```
## Usage
Run the script against a REDAXO target:
```bash
python3 poc.py --target https://target.example --login adm