CVE-2026-59080
Received Received - Intake

Edito CMS JWT Token Exposure via GET Requests

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: CERT.PL

Description
Edito CMS sends JWT token via GET requests. This allows a local attacker with access to browser history to obtain valid JWT token and perform action on behalf of the victim. The token is valid for only short period of time; after that time, it expires and can no longer be used. The vendor assessed the likelihood of exploitation as very low and determined that a fix is not necessary.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-59080
EUVD
EUVD-2026-124882

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Edito Edito CMS From 0 (inc) to 5.10.2607 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-598 The web application uses an HTTP method to process a request, but the request includes sensitive information in the query string.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Edito CMS sends JWT tokens via GET requests. This means the token is exposed in the URL or browser history. A local attacker with access to browser history could steal the token and impersonate the victim. The token has a short validity period before expiring.

Detection Guidance

Check browser history for Edito CMS GET requests containing JWT tokens. Inspect network traffic logs for GET requests with tokens in URLs. Monitor for unusual authenticated actions from local users.

Impact Analysis

If you use Edito CMS, an attacker with access to your browser history could steal your JWT token and perform actions on your behalf. This could lead to unauthorized changes or data access. The risk is limited by the short token validity.

Compliance Impact

This vulnerability could potentially violate GDPR or HIPAA by exposing user authentication tokens, leading to unauthorized access to personal or sensitive data. However, the vendor considers the risk very low and no fix is planned.

Mitigation Strategies

Disable JWT token transmission via GET requests in Edito CMS configuration. Implement token expiration policies. Restrict local user access to browser history and network logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59080. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...