REDAXO before version 5.21.5 allows attackers who obtain a user’s session ID or stay‑logged‑in cookie to keep the administrative back‑end accessible after a password change. The session cookie remains valid for up to three months, which effectively permits unauthorized persistence of access. This flaw is classified as a session‑management weakness (CWE‑613).

The vulnerability affects the Redaxo core product. All releases dated earlier than 5.21.5 are impacted and require the upgrade to 5.21.5 or a later version to be remedied.

The CVSS score of 2.3 indicates a low base severity, and the EPSS score is not provided, suggesting no current exploit data. The vulnerability is not listed in the CISA KEV catalog. An attacker must already possess or hijack a valid session or stay‑logged‑in cookie to exploit the flaw; the attack is not remote from a network perspective and is likely executed locally or through a compromised user account. If the attacker succeeds, they can maintain unfettered administrative access for up to three months, which poses a significant compromise risk to confidentiality and integrity within the affected system.