Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-84155— Session Token Remains Valid After Logout in Multi-Worker Deployments

Quick assessment

Affected
Ericsson CodeChecker
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

当 CodeChecker 的 Web 服务器在默认配置（即启用多个 API 工作进程）下运行时，其登出功能无法彻底使会话令牌失效。每个工作进程都维护自己的内存会话缓存；执行登出操作时，仅会清除处理该请求的单个工作进程的缓存（同时也会更新共享数据库中的记录）。其他工作进程仍会继续从其过时的内存副本中认可已被销毁的令牌，直到该会话的生命周期自然到期。因此，若攻击者已截获有效的令牌，即可在用户登出后继续冒充该用户。

CVSS 5.3 · Medium

Possible ATT&CK Techniques 1 AI

T1550.004 · Web Session Cookie
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-84155

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Session Token Remains Valid After Logout in Multi-Worker Deployments
Source: CVE Program / CVE List V5
Vulnerability Description
CodeChecker's web server fails to fully invalidate a session token on logout when the server runs with more than one API worker process (the default). Each worker process maintains its own in-memory session cache; logout only clears the cache of the single worker that handles the request (plus the shared database record). Other workers continue to honor the destroyed token from their stale in-memory copies until the session's lifetime expires. An attacker who has captured a valid token can therefore keep impersonating the user after the user has logged out.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
不充分的会话过期机制
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Ericsson CodeChecker 0 ~ 6.29.3 -

II. Public POCs for CVE-2026-84155

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-84155

请登录查看更多情报信息。

Other References for CVE-2026-84155 (1)

Same Patch Batch · Ericsson · 2026-11-06 · 3 CVEs total

CVE-2026-84161 4.9 MEDIUM Authenticated remote denial of service through unbounded zlib decompression in storeAnalys
CVE-2026-84164 Stored XSS in the static HTML report export, because json.dumps does not escape the markup

IV. Related Vulnerabilities

Same product: CodeChecker
Same vendor: Ericsson
Same weakness: CWE-613