CVE-2026-92920

Impact

admin3 through 3.0.0 fails to invalidate existing sessions when disabling a user account, allowing attackers to retain authenticated access with original permissions. Attackers can continue using bearer tokens issued before account disablement to authenticate requests, as the AuthInterceptor never re-validates the user's locked status and session expiry resets on each request.

Affected products

Versions were read from the advisory text. No structured product data has been published for this record yet.

Weakness classification

References

• NVD record
• CVE.org record
• https://github.com/LinYuanyi1/cve-request-poc/blob/master/admin3/C06_account_lockout_bypass.py
• https://github.com/cjbi/admin3
• https://github.com/cjbi/admin3/blob/3.0.0/admin3-server/src/main/java/tech/wetech/admin3/infra/AuthInterceptor.java
• https://github.com/cjbi/admin3/blob/3.0.0/admin3-server/src/main/java/tech/wetech/admin3/infra/service/LocalSessionManager.java
• https://github.com/cjbi/admin3/blob/3.0.0/admin3-server/src/main/java/tech/wetech/admin3/sys/service/UserService.java
• https://www.vulncheck.com/advisories/admin3-through-3.0.0-session-not-invalidated-when-a-user-account-is-disabled