A flaw in Ansible Lightspeed allows a remote attacker to hijack sessions by capturing a valid OAuth access token before the user logs out. Because the application does not invalidate the token on the backend, the token remains usable until its natural expiration, giving the attacker persistent authenticated access. This enables unauthorized reading of sensitive Ansible resources such as inventories, playbooks, and configuration data.

The vulnerability affects Red Hat Ansible Automation Platform versions 2 and 2.7 for Enterprise Linux 9. Users running these releases are at risk until they apply the Red Hat update that addresses session expiration handling.

The CVSS score of 5.3 indicates a medium severity vulnerability. The EPSS score is not available, and the issue is not listed in CISA's KEV catalog. A remote attacker who can exfiltrate an OAuth token before logout can maintain authenticated access, potentially exfiltrating protected data. The likelihood of exploitation depends on the presence of exposed tokens and whether users log out; however, once a token is obtained, the attacker can read any data accessible to that token for the remainder of its lifespan.