CVE-2026-28275 - Vulnerability Analysis

Overview

Initiative < 0.32.4 contains a broken authentication caused by failure to invalidate JWT access tokens after password change, letting attackers continue authenticated access, exploit requires valid token before password change.

Severity & Score

Impact

Attackers can use old JWT tokens to access protected endpoints even after password change, risking unauthorized access.

Mitigation

Upgrade to version 0.32.4 or later.

References

• https://github.com/Morelitea/initiative/releases/tag/v0.32.4
• https://github.com/Morelitea/initiative/security/advisories/GHSA-hww6-3fww-xw3h

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Feb 27, 2026

🟠 CVE-2026-28275 - High (8.1) Initiative is a self-hosted project management platform. Versions of the application prior to 0.32.4 do not invalidate previously issued JWT access tokens after a user changes their password. As a result, older tokens remain valid until expiration... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28275/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner