Vulnerability details

CVE-2026-92918

cjbi admin3

admin3 through 3.0.0 Session Token Disclosure via Audit Log

CVSS 4.0

8.7High

Official description

admin3 through 3.0.0 persists user session tokens in the audit log event body when publishing UserLoggedIn domain events. Attackers with log:view permission can read the JSON response from the GET /logs endpoint to harvest session tokens and replay them as bearer credentials for full user access.

CVSS scores

Score	Version	Source	Vector
8.7High	4.0	CVEProject cvelistV5 (CNA) (VulnCheck)	`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`
8.8High	3.1	CVEProject cvelistV5 (CNA) (VulnCheck)	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`

Affected products

Vendor	Product	Versions	Source
cjbi	admin3	v ≤ 3.0.0	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/LinYuanyi1/cve-request-poc/blob/master/admin3/C02_log_session_token_disclosure.py exploit
https://github.com/cjbi/admin3/blob/3.0.0/admin3-server/src/main/java/tech/wetech/admin3/sys/service/LogService.java technical-description
https://github.com/cjbi/admin3/blob/3.0.0/admin3-server/src/main/java/tech/wetech/admin3/infra/service/DefaultSessionService.java technical-description
https://github.com/cjbi/admin3/blob/3.0.0/admin3-server/src/main/resources/data.sql technical-description
https://github.com/cjbi/admin3 product
https://www.vulncheck.com/advisories/admin3-through-3.0.0-session-token-disclosure-via-audit-log third-party-advisory

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-09-17
Last updated: 2026-09-24
State: Published
Assigner (CNA): VulnCheck

Exploit prediction (EPSS)

0.64%

Probability of exploitation in 30 days

51.3%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: Proof of concept
Technical impact: Total

Weaknesses (CWE)

CWE-532
Insertion of Sensitive Information into Log File