CVE-2026-34828
published 2026-04-02CVE-2026-34828: listmonk is a standalone, self-hosted, newsletter and mailing list manager. From version 4.1.0 to before version 6.1.0, a session management vulnerability…
PriorityP343high7.1CVSS 3.1
AVNACLPRLUINSUCHILAN
EPSS
0.30%
21.6th percentile
listmonk is a standalone, self-hosted, newsletter and mailing list manager. From version 4.1.0 to before version 6.1.0, a session management vulnerability allows previously issued authenticated sessions to remain valid after sensitive account security changes, specifically password reset and password change. As a result, an attacker who has already obtained a valid session cookie can retain access to the account even after the victim changes or resets their password. This weakens account recovery and session security guarantees. This issue has been patched in version 6.1.0.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | knadh_listmonk | >= 1.1.1-0.20241028090858-319053dd7a90 < 1.1.1-0.20260329113754-1b5e8d38c778 | 1.1.1-0.20260329113754-1b5e8d38c778 |
| knadh | listmonk | — | — |
| nadh | listmonk | >= 4.1.0 < 6.1.0 | 6.1.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
listmonk's active sessions remain valid after password reset and password change
ghsa·2026-04-01
CVE-2026-34828 [HIGH] CWE-613 listmonk's active sessions remain valid after password reset and password change
listmonk's active sessions remain valid after password reset and password change
### Summary
A session management vulnerability allows previously issued authenticated sessions to remain valid after sensitive account security changes, specifically password reset and password change. As a result, an attacker who has already obtained a valid session cookie can retain access to the account even after the victim changes or resets their password.
This weakens account recovery and session security guarantees. I reproduced the issue on listmonk v6.0.0.
### Details
The application updates account credentials successfully, but existing active sessions are not revoked afterward.
This behavior was confirmed in two flows:
1. **Password reset flow**
- A user resets their password through the forgot
OSV
listmonk's active sessions remain valid after password reset and password change
osv·2026-04-01
CVE-2026-34828 [HIGH] listmonk's active sessions remain valid after password reset and password change
listmonk's active sessions remain valid after password reset and password change
### Summary
A session management vulnerability allows previously issued authenticated sessions to remain valid after sensitive account security changes, specifically password reset and password change. As a result, an attacker who has already obtained a valid session cookie can retain access to the account even after the victim changes or resets their password.
This weakens account recovery and session security guarantees. I reproduced the issue on listmonk v6.0.0.
### Details
The application updates account credentials successfully, but existing active sessions are not revoked afterward.
This behavior was confirmed in two flows:
1. **Password reset flow**
- A user resets their password through the forgot
No detection rules found.
No public exploits indexed.
2026-04-02
Published