Pretix
CVE-2026-101272: The mechanism binding files generated during a shredding process to the authentication method is not working correctly and the same session token is used for al
CVE-2026-101272 Oct 28, 2026 Source: Vendor
The mechanism binding files generated during a shredding process to the authentication method is not working correctly and the same session token is used for all token-based API users. This is similar to an issue fixed in 2026.7.1 but was missed while creating the fix. Since the files are referred to by randomly generated UUIDs and only exist for a day, there is virtually no risk, but it renders the added protection mechanism useless. As part of the fix, we have also improved hardening of some o
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://nvd.nist.gov/vuln/detail/CVE-2026-101272
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
1 line
Showing 1–1 of 1 matching , clear filters
CVE-2026-101272
BR2026-0000-037359
unclaimed
Credited as Sahil Kushwaha