CVE-2026-73611

CVE-2026-73611CVE-2026-73611

Description

File Browser versions from 2.50.0 through 2.63.21 fail to validate JWT expiration when proxy authentication is configured with a non-default logout page. Attackers with a previously valid token can access protected routes and administrative endpoints indefinitely, and exchange expired tokens for fresh ones via the renewal endpoint.

Scoring

CVSS 6.8 ()
VectorCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Last modified2026-08-13
Sourced from NVD. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.