CVE-2026-74037 — Wazuh 4.0.0 before 4.14.8 Session Invalidation Bypass in check_token
Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for run_as users with zero static roles, because check_token never consults the blacklist. Attackers with revoked adm…
Published: 2026-10-13 · CVSS: 8.6 · CVSS 4.0
Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for run_as users with zero static roles, because check_token never consults the blacklist. Attackers with revoked administrator grants can continue authenticating and self-link the administrator role to permanently retain privileged access.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7