CVE-2026-34828

CVE-2026-34828 describes a high-severity session management vulnerability in listmonk versions 4.1.0 through 6.0.x, where authenticated sessions persist even after a user changes or resets their password. This flaw allows an attacker with a previously obtained session cookie to retain unauthorized access, posing a significant risk to account confidentiality. Rated CVSS 7.1, it has a network attack vector and low attack complexity, requiring low privileges (an existing session) to exploit. The vulnerability weakens account recovery and session security guarantees. There is currently no evidence of active exploitation, public exploit code, or significant community discussion regarding this CVE.