Cyber ·
CVE-2026-86589: Apache Answer does not revoke sessions after central account suspension
Moderate-severity flaw in the User Center login integration of Apache Answer up to version 2.0.2. Newly created sessions may lack the external identity, letting later requests bypass suspension or deletion checks on the central account until the session ends.
Radar records advisory CVE-2026-86589, posted to the oss-sec feed on 15 October by Enxin Xie and captured by our source on 16 October 2026. The source rates severity as moderate and affects Apache Answer up to version 2.0.2. The flaw is in the authentication logic: when a user signs in through the User Center integration, the new session may not carry the external identity. Later requests can then pass checks that should block suspended or deleted accounts in the central account. The description says the effect lasts while the session remains valid. The text was machine-translated by the source, so technical details should be confirmed in the original. To verify, consult the original advisory linked in the source on the oss-sec archive, compare it with the official CVE record and the Apache Answer release notes. Confirm your installed version before taking any action.