CVE-2026-105690: Penpot Session Management Auth Bypass

CVE-2026-105690 Overview

CVE-2026-105690 affects Penpot, an open-source design and prototyping platform. Versions prior to 2.18.0 fail to invalidate server-side sessions when a user logs out. The logout flow clears the browser's auth-token cookie but does not revoke the corresponding session record on the backend. An attacker holding a previously captured session token can continue issuing authenticated requests under the victim's identity until the token reaches natural expiration. The weakness is classified as insufficient session expiration [CWE-613]. Penpot addressed the issue in version 2.18.0 by ensuring the logout handler reads the session identifier from the active session object and explicitly deletes it from the session manager.

Critical Impact

Captured session tokens remain valid after the victim logs out, allowing attackers to maintain unauthorized access to Penpot projects, workspaces, and user data.

Affected Products

• Penpot versions prior to 2.18.0
• Self-hosted Penpot instances using vulnerable backend session management
• Penpot deployments relying on cookie clearing as the sole logout mechanism

Discovery Timeline

• 2026-10-05 - CVE-2026-105690 published to NVD
• 2026-10-05 - Last updated in NVD database

Technical Details for CVE-2026-105690

Vulnerability Analysis

The flaw resides in Penpot's backend HTTP session middleware. On logout, the application cleared the client-side auth-token cookie but did not remove the server-side session record. Because session validation relies on the backend record remaining present, any attacker who previously captured a valid session token through cross-site scripting, malware, shared devices, or network interception could keep using it.

The captured token continued to authorize API requests with the victim's privileges. Logout gave users a false sense of security while leaving a working credential in the wild. The exploitation window extended until the backend session reached its natural expiration, which could be hours or days depending on configuration.

Root Cause

The root cause is a lookup mismatch in the session-invalidation code path. The logout handler attempted to delete a session using an identifier field (::id) that was not populated in the request context, so no record was ever removed. The fix retrieves the session identifier from the resolved ::session object before calling delete-session.

Attack Vector

Exploitation requires an attacker to first obtain a valid session token through a separate channel. Once obtained, the attacker can replay the token against the Penpot API after the victim has logged out. User interaction is required because the victim must have authenticated and logged out, but no further interaction is needed for continued abuse. The attack is remotely exploitable across the network.

;; Source: https://github.com/penpot/penpot/commit/7c85837290c4e7d6f7d99472b092ad4f7c9d6a97
;; Patch in backend/src/app/http/session.clj
;; The fix replaces the unreliable ::id lookup with the session object's :id,
;; ensuring the server-side session is actually deleted on logout.
   [{:keys [::manager]}]
   (assert (manager? manager) "expected valid session manager")
   (fn [request response]
-    (some->> (get request ::id) (delete-session manager))
+    (some->> (get request ::session) :id (delete-session manager))
     (clear-session-cookie response)))

 (defn decode-token

Detection Methods for CVE-2026-105690

Indicators of Compromise

• Authenticated API requests originating from IP addresses or user agents that differ from the user's recent interactive session.
• Continued activity under a user account after a logout event has been recorded in application logs.
• Session tokens appearing in traffic from unexpected geographic locations or ASNs following a legitimate logout.

Detection Strategies

• Correlate logout events in Penpot application logs with subsequent authenticated API activity using the same session identifier.
• Instrument the session manager to log session deletions and alert when authenticated requests use tokens that should have been invalidated.
• Review web server access logs for long-lived session cookies that persist across logout boundaries.

Monitoring Recommendations

• Enable detailed audit logging for authentication, logout, and session lifecycle events in Penpot.
• Forward Penpot logs to a centralized analytics platform and build detections for post-logout session reuse.
• Monitor for anomalous session durations that exceed configured idle or absolute timeouts.

How to Mitigate CVE-2026-105690

Immediate Actions Required

• Upgrade all Penpot instances to version 2.18.0 or later without delay.
• Force logout and invalidate all active sessions for every user after upgrading to clear any tokens issued under the vulnerable build.
• Rotate any shared or service account credentials that may have been used on vulnerable Penpot instances.

Patch Information

The vulnerability is fixed in Penpot 2.18.0. The patch, delivered in commit 7c85837290c4e7d6f7d99472b092ad4f7c9d6a97, corrects the logout middleware so the session identifier is resolved from the active session object and passed to delete-session. See the GitHub Security Advisory GHSA-mj9f-5cwq-7p3q and the Penpot 2.18.0 release notes for additional context.

Workarounds

• Reduce the configured session lifetime to shrink the window during which a captured token remains valid.
• Restrict administrative access to Penpot from trusted networks only while upgrade planning is underway.
• Advise users to close their browser and clear cookies after sensitive sessions to limit token exposure.

# Upgrade a Docker Compose Penpot deployment to the patched release
docker compose pull
docker compose down
# Pin the backend image to the fixed version
sed -i 's|penpotapp/backend:.*|penpotapp/backend:2.18.0|' docker-compose.yml
sed -i 's|penpotapp/frontend:.*|penpotapp/frontend:2.18.0|' docker-compose.yml
docker compose up -d