Authentication Algorithm Vulnerability in Apache Answer

CVE-2026-86589

What is CVE-2026-86589?

A vulnerability exists in Apache Answer prior to version 2.0.3 due to an incorrect implementation of the authentication algorithm. This flaw affects the User Center's login integration, allowing a newly created external user session to omit its external identity. As a result, this oversight enables subsequent requests to bypass checks meant to enforce account suspension or deletion, posing a significant security risk until the session expires or is revoked. To mitigate this vulnerability, users are strongly advised to upgrade to version 2.0.3.

References