{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24667", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-23T20:40:23.387Z", "datePublished": "2026-02-03T16:59:32.119Z", "dateUpdated": "2026-02-04T16:51:49.025Z"}, "containers": {"cna": {"title": "Open eClass's Active Sessions Not Invalidated After Password Change Allow Persistent Account Access", "problemTypes": [{"descriptions": [{"cweId": "CWE-613", "lang": "en", "description": "CWE-613: Insufficient Session Expiration", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/gunet/openeclass/security/advisories/GHSA-5h73-53mh-m224", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/gunet/openeclass/security/advisories/GHSA-5h73-53mh-m224"}], "affected": [{"vendor": "gunet", "product": "openeclass", "versions": [{"version": "< 4.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-03T16:59:32.119Z"}, "descriptions": [{"lang": "en", "value": "The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, failure to invalidate active user sessions after a password change allows existing session tokens to remain valid, potentially enabling unauthorized continued access to user accounts. This issue has been patched in version 4.2."}], "source": {"advisory": "GHSA-5h73-53mh-m224", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-04T15:46:28.905681Z", "id": "CVE-2026-24667", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-04T16:51:49.025Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24667", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-04T15:46:28.905681Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-04T15:46:29.606Z"}}], "cna": {"title": "Open eClass's Active Sessions Not Invalidated After Password Change Allow Persistent Account Access", "source": {"advisory": "GHSA-5h73-53mh-m224", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "gunet", "product": "openeclass", "versions": [{"status": "affected", "version": "< 4.2"}]}], "references": [{"url": "https://github.com/gunet/openeclass/security/advisories/GHSA-5h73-53mh-m224", "name": "https://github.com/gunet/openeclass/security/advisories/GHSA-5h73-53mh-m224", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, failure to invalidate active user sessions after a password change allows existing session tokens to remain valid, potentially enabling unauthorized continued access to user accounts. This issue has been patched in version 4.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-613", "description": "CWE-613: Insufficient Session Expiration"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-03T16:59:32.119Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24667", "state": "PUBLISHED", "dateUpdated": "2026-02-04T16:51:49.025Z", "dateReserved": "2026-01-23T20:40:23.387Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-03T16:59:32.119Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gunet:open_eclass_platform:*:*:*:*:*:*:*:*", "matchCriteriaId": "62F1C084-2C90-4AB3-A13E-28323DC385C0", "versionEndExcluding": "4.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, failure to invalidate active user sessions after a password change allows existing session tokens to remain valid, potentially enabling unauthorized continued access to user accounts. This issue has been patched in version 4.2."}], "id": "CVE-2026-24667", "lastModified": "2026-02-10T18:35:19.530", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 3.4, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2026-02-03T18:16:19.917", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/gunet/openeclass/security/advisories/GHSA-5h73-53mh-m224"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-613"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T00:16:57.544253+00:00", "value": {"mitigation_remediation": ["Apply the official update to Open eClass version 4.2 or later to ensure that session tokens are invalidated immediately after a password change.", "If upgrading is not possible, enforce a manual session flush (remove all active session records) immediately following any password change through custom administrative scripts or database operations.", "Implement monitoring to detect any sessions that persist beyond a password change event, and audit user activity logs for suspicious continued access."], "summary": {"action": "Update", "impact": "Account hijacking via persistent session tokens"}, "threat_synthesis": {"affected_systems": "The issue affects the Open eClass community edition released as gunet:openeclass. Versions built from source prior to 4.2 are vulnerable; the fix was included in release 4.2 and later.", "description_and_impact": "Active user sessions in the Open eClass platform are not cleared when a password change occurs, which means a session token that was issued before the password was changed can still be used, allowing an attacker to maintain access to an account without needing the new credentials. This flaw enables the persistence of a compromised session and therefore can lead to unauthorized disclosure, tampering, or destruction of a user\u2019s data, classified as a session hijacking weakness (CWE-613).", "risk_and_exploitability": "The base severity of the vulnerability is a moderate CVSS score of 5.0, and the EPSS score indicates an exploitation probability of less than 1%. The flaw is not listed in the CISA Known Exploited Vulnerabilities catalog. Based on the description, the likely attack vector is an authenticated or partially authenticated operation where the attacker already possesses a valid session cookie or token; the attacker could also acquire a session token through other vulnerabilities such as XSS, but this is not explicitly disclosed. Exploitation requires that the attacker leverage a session that remained active after a password change and does not involve a separate vulnerability to obtain that token. The risk is that an attacker who gains ownership of a session token can continue to use the account with no indication of the password change; ongoing monitoring of session activity and audit logs is advised."}}}}, "created": "2026-02-04T12:09:48.186832+00:00", "updated": "2026-04-18T00:30:25.700740+00:00", "vendors": ["openeclass", "openeclass$PRODUCT$openeclass"]}