{"affected":[{"defaultStatus":"affected","product":"Edito CMS","source":"CNA: CERT-PL","vendor":"Edito","versions":[{"lessThanOrEqual":"5.10.2607","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-59080","cwes":["CWE-598"],"description":"Edito CMS sends JWT token via GET requests. This allows a local attacker with access to browser history to obtain valid JWT token and perform action on behalf of the victim. The token is valid for only short period of time; after that time, it expires and can no longer be used.\n\n\n\nThe vendor assessed the likelihood of exploitation as very low and determined that a fix is not necessary.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":2.1,"severity":"low","source":"CNA: CERT-PL","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","version":"4.0"}],"modifiedAt":1794554927080,"publishedAt":1794554927080,"references":[{"source":"CNA: CERT-PL","tags":["third-party-advisory"],"url":"https://cert.pl/posts/2026/11/CVE-2026-59081"},{"source":"CNA: CERT-PL","tags":["product"],"url":"https://www.edito.pl/"}],"remediation":[],"revision":"513fde81376beddd5b0d3ee751207afc858afb24b331ea1b98c63c60a08f1291","sources":[{"modifiedAt":1794554927080,"name":"CNA: CERT-PL","retrievedAt":1794557324481,"url":"https://www.cve.org/CVERecord?id=CVE-2026-59080"}],"ssvc":null,"status":"published","title":"JWT Exposure via GET Request in Edito CMS","updatedAt":1794557324481}