JWT Token Exposure in Edito CMS by Edito
CVE-2026-59080

2.1LOW

Key Information:

Vendor

Edito

Status
Edito Cms
Vendor
CVE Published:
13 November 2026

What is CVE-2026-59080?

Edito CMS features a vulnerability where JWT tokens are transmitted via GET requests, potentially exposing them to local attackers. If an attacker gains access to the browser history, they can retrieve valid JWT tokens and perform unauthorized actions on behalf of the user. Although the tokens have a limited validity period and expire after a short duration, this exposure could lead to security breaches if not properly addressed.

Affected Version(s)

Edito CMS 0 <= 5.10.2607

References

https://cert.pl/posts/2026/11/CVE-2026-59081
third-party-advisory
https://www.edito.pl/
product

CVSS V4

Score:
2.1
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Michał Majchrowicz (AFINE Team)
Dawid Małecki (AFINE Team)
​Paweł Zdunek (AFINE Team)
.