CVE-2026-60053
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
Apache Answer through version 2.0.1 has insufficient session expiration: administrative API keys remain usable after the owning administrator is demoted or the account is marked inactive, suspended, or deleted, allowing continued access until the keys are explicitly removed.
Risk Assessment
Individuals with stale API keys may retain unauthorized administrative access, posing a serious threat to system confidentiality and integrity.
Recommendation
Upgrade Apache Answer to version 2.0.2, which fixes the issue, and regularly review and remove unused API keys.
Original NVD description (English source)
Insufficient Session Expiration vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Administrative API keys remained usable after the owning administrator was demoted or the account was marked inactive, suspended, or deleted, allowing continued access until the keys were explicitly removed. Users are recommended to upgrade to version 2.0.2, which fixes the issue.