REDAXO Core: Authentication bypass via forgeable temporary login token

Summary

REDAXO Core versions from 5.3.0 up to 5.21.3 contain an authentication bypass in the structure/history plugin. An unauthenticated attacker can forge a temporary login token and obtain a backend session, including for administrator accounts. Only installations with the history plugin active are affected, and on installations not running in live mode the access can be escalated to code execution.

Affected

• REDAXO Core >= 5.3.0 and < 5.21.4
• Only with the structure/history plugin installed and activated (not enabled by default)

Fixed in

• Upgrade to REDAXO Core 5.21.4 or later (5.21.5 also contains further security fixes)

Workaround

• Deactivate the structure/history plugin
• Alternatively, apply the one-line change to redaxo/src/addons/structure/plugins/history/boot.php (line 16) described in the vendor advisory, which disables the temporary login for frontend history views; snapshots continue to be recorded

Exploitation

• Not known to be exploited (OffSeq, Strix, no honeypot traffic recorded)
• A public repository titled as a PoC exists; its author states the full attack chain is not yet working. Unverified.
• Sources disagree on the CVSS base score (9.3 per CVE record, 9.8 CVSS 3.1 per Strix, 7.3 per VulDB)

Our recommendation

• Update REDAXO to 5.21.5 (or at least 5.21.4) without delay
• If the history plugin is not needed, deactivate it
• Check whether the history plugin is active on your sites
• Review backend logins and administrator accounts for unexpected activity, since the fix dates from August 2026 and older sites may already be compromised
• Restrict backend access and enable live mode where editing is not required

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  asvorg/CVE-2026-117532-poc

Research sources

• GitHub Security Advisory GHSA-px8f-whj8-hrpq github.com
• GitHub release REDAXO 5.21.4 github.com
• GitHub release REDAXO 5.21.5 github.com
• VulnCheck advisory www.vulncheck.com
• Strix CVE summary www.strix.ai
• OffSeq radar threat entry radar.offseq.com
• VulDB entry vuldb.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 00:37.