CVE-2026-73611 — File Browser 2.50.0 through 2.63.21 JWT Expiration Bypass
File Browser versions from 2.50.0 through 2.63.21 fail to validate JWT expiration when proxy authentication is configured with a non-default logout page. Attackers with a previo…
Published: 2026-08-13 · CVSS: 7.6 · CVSS 4.0
File Browser versions from 2.50.0 through 2.63.21 fail to validate JWT expiration when proxy authentication is configured with a non-default logout page. Attackers with a previously valid token can access protected routes and administrative endpoints indefinitely, and exchange expired tokens for fresh ones via the renewal endpoint.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7