Session Management Flaw in Redmine Affects User Authentication
CVE-2021-37156

7.5HIGH

Key Information:

Vendor: Redmine
Status: Redmine
Vendor: CVE Published:; 5 August 2021

What is CVE-2021-37156?

In Redmine versions 4.2.0 and 4.2.1, a session management flaw allows existing user sessions to remain active even after a user enables two-factor authentication. This behavior contradicts the expected security measure of terminating old sessions to prevent unauthorized access. Ensuring proper session handling during changes in authentication settings is critical to maintaining user security.