CVE-2026-34828 - Vulnerability Analysis

Overview

listmonk 4.1.0 to < 6.1.0 contains a session management vulnerability caused by previously issued sessions remaining valid after password reset/change, letting attackers retain account access, exploit requires attacker to have a valid session cookie.

Severity & Score

Impact

Attackers with a valid session cookie can maintain account access despite password changes, weakening account security.

Mitigation

Upgrade to version 6.1.0 or later.

References

• https://github.com/knadh/listmonk/commit/db82035d619348949512dafdaf60c86037cafc9e
• https://github.com/knadh/listmonk/releases/tag/v6.1.0
• https://github.com/knadh/listmonk/security/advisories/GHSA-h5j9-cvrw-v5qh

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner