Description
admin3 through 3.0.0 fails to invalidate existing sessions when disabling a user account, allowing attackers to retain authenticated access with original permissions. Attackers can continue using bearer tokens issued before account disablement to authenticate requests, as the AuthInterceptor never re-validates the user's locked status and session expiry resets on each request.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
cjbi admin3
Default version status: unaffected
0 to ≤ 3.0.0affected
pkg:github/cjbi/admin3References
- https://github.com/LinYuanyi1/cve-request-poc/blob/master/admin3/C06_account_lockout_bypass.py ↗
- https://github.com/cjbi/admin3/blob/3.0.0/admin3-server/src/main/java/tech/wetech/admin3/sys/service/UserService.java ↗
- https://github.com/cjbi/admin3/blob/3.0.0/admin3-server/src/main/java/tech/wetech/admin3/infra/AuthInterceptor.java ↗
- https://github.com/cjbi/admin3/blob/3.0.0/admin3-server/src/main/java/tech/wetech/admin3/infra/service/LocalSessionManager.java ↗
- https://github.com/cjbi/admin3 ↗
- https://www.vulncheck.com/advisories/admin3-through-3.0.0-session-not-invalidated-when-a-user-account-is-disabled ↗