The vulnerability resides in the structure/history plugin of Redaxo core 5.3.0 through 5.21.4, enabling unauthenticated attackers to forge temporary login tokens. By forcing the session‑tied secret into a predictable state, attackers can create tokens for privileged accounts such as admin, gaining full backend access and the ability to execute code outside the live mode. The flaw is a classic authentication bypass (CWE‑287) that compromises confidentiality, integrity, and availability of the system.

Affected vendor: Redaxo, product: Redaxo Core. All releases from 5.3.0 up to but not including 5.21.4 are vulnerable. Applying any patch version 5.21.4 or newer resolves the issue.

The CVSS score of 9.3 indicates critical severity. No EPSS score is available, and the CVE is not listed in the CISA KEV catalog; however, the lack of publicly known exploits does not reduce the inherent risk. The flaw can be exploited remotely by any actor who can trigger the vulnerable plugin, as the authentication bypass requires no prior credentials. Attackers may force the predictable secret state through crafted requests, then forge valid session tokens targeting privileged accounts. Given the high impact, the combination of a high CVSS score and the ability to execute code on the backend creates a compelling reason to remediate immediately.