CVE-2026-88533: LiveViews jiti session revocation bypass

Vulnerability Summary: Revoked Sessions Remain Authenticated in LiveViews Vulnerability Overview Vulnerability Name: When is , revoked sessions remain authenticated in LiveViews. Severity: High CVE ID: CVE-2026-88533 Root Cause: The write-side intentionally stores as , allowing specific sessions to be revoked via . However, the read-side , upon matching , binds to an undefined variable and returns . Consequently, the read path directly returns and never queries the revocation record. As a result, captured session values remain valid until the underlying expires, rendering revocation operations ineffective. Affected Scope Affected Versions: and Fixed Versions: , Attack Vector: Network Impact: Session revocation is ineffective. Anyone holding a copy of a session value (e.g., via shared/hosted devices, proxy/telemetry interception, backups, or previous breaches) remains authenticated even after password changes or administrative revocation. CVSS 3.1 Vector: (Score: 7.4, High) CWE: CWE-287 (Improper Authentication), CWE-613 Remediation 1. Add Read-Path Check: Accept an indexed token resource lookup for authenticated sessions and allow as a pattern to enable revocation. 2. Deprecate : Shift to setting to , as revocable session identifiers bypass the revocation storage read. Mitigations: Set to (most effective mitigation; the read path will query the token resource and correctly reject revoked sessions). Shorten token lifetimes to reduce the impact window for captured session values. In affected configurations, revoke sessions by clearing browser cookies. POC / Exploit Code No standalone POC or exploit code block is included in the page; the reproduction scenario is described only in text (specifically: for PostgreSQL, with set to and set to , the read path still returns , making revocation ineffective).

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-88533: LiveViews jiti session revocation bypass

More from this source