Session Management Flaw in Penpot Open-Source Design Platform

CVE-2026-105690

What is CVE-2026-105690?

Penpot, an open-source design and prototyping platform, suffers from a vulnerability where the logout function incorrectly clears the browser's authentication token cookie but does not revoke the corresponding server-side session. As a result, an attacker can use a previously captured session token to perform unauthorized actions on behalf of the logged-out user until that session naturally expires. This issue has been addressed in version 2.18.0, where appropriate session termination measures have been implemented.

References