CVE-2021-3311
9.8 CRITICALAn issue was discovered in October through build 471
Published: 2021-02-05 · Last updated: 2026-06-17
Severity and scoring
- CVSS
- 9.8 CRITICAL
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CWE
- CWE-613
Affected products
| Vendor | Product |
|---|---|
| octobercms | october |
Description
An issue was discovered in October through build 471. It reactivates an old session ID (which had been invalid after a logout) once a new login occurs. NOTE: this violates the intended Auth/Manager.php authentication behavior but, admittedly, is only relevant if an old session ID is known to an attacker.
Source: NVD
References
- [NVD]https://nvd.nist.gov/vuln/detail/CVE-2021-3311
- [Exploit reference]https://anisiosantos.me/october-cms-token-reactivation
- [Patch]https://github.com/octobercms/library/commit/642f597489e6f644d4bd9a0c267e864cabead024
- [Vendor advisory]https://octobercms.com/forum/chan/announcements
- [Exploit reference]https://anisiosantos.me/october-cms-token-reactivation
- [Patch]https://github.com/octobercms/library/commit/642f597489e6f644d4bd9a0c267e864cabead024
- [Vendor advisory]https://octobercms.com/forum/chan/announcements
Related CVEs
Same vendor
- CVE-2021-41126 — October is a Content Management System (CMS) and web platform built on the the Laravel PHP Framework (7.2 HIGH)
Same CWE
- CVE-2026-53843 — OpenClaw before 2026.5.26 contains an authorization bypass vulnerability where a surviving pairing-scoped device session can re-establish... (8.8 HIGH)
- CVE-2026-53776 — Perry before 0.5.1166 contains a JWT validation vulnerability that allows remote attackers to bypass token expiration by exploiting the u... (9.1 CRITICAL)
- CVE-2026-44188 — A flaw was found in Ansible Lightspeed (5.3 MEDIUM)
- CVE-2026-53830 — OpenClaw before 2026.4.22 contains a webhook secret revocation bypass vulnerability allowing callers with old Slack and Zalo webhook secr... (6.5 MEDIUM)
- CVE-2026-53824 — OpenClaw before 2026.4.24 contains a token revocation vulnerability allowing callers with revoked slash tokens to continue executing comm... (6.5 MEDIUM)