CVE-2026-14950
CriticalCVSS 9.8Summary
An unauthenticated remote attacker with a valid session identifier can continue using the session after expiration. This increases risks associated with stolen or shared sessions and may enable unauthorized continued access to the FDS web interface.
Risk Assessment
The risk includes prolonged unauthorized access to the FDS system, potentially leading to data confidentiality and integrity breaches.
Recommendation
Implement server-side session expiration enforcement and regularly invalidate sessions after logout.
Original NVD description (English source)
An unauthenticated remote attacker in possession of a valid session identifier is able to continue using the session after it should have expired. This increases the risk associated with stolen, leaked, shared, or unattended sessions and may enable unauthorized continued access to the FDS web interface.