External risk intelligence

REDAXO Core Authentication Bypass via Structure History Plugin

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-117532

REDAXO is a content management system designed for public-facing web presence. As a web application, it is commonly deployed on servers accessible via the internet, and the affected authentication functionality is a standard part of the web-based administrative backend.

Authentication Bypass

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in the REDAXO core's history plugin that could allow unauthorized access to administrative functions. This issue enables attackers to bypass authentication, potentially leading to unauthorized code execution within the system.

Bypasses authentication, allowing unauthorized access.
Could lead to unauthorized administrative control and code execution.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can reach the vulnerability by exploiting a weakness in the structure/history plugin. This plugin's predictable state allows an unauthenticated user to create temporary login tokens. By forging tokens for accounts like admin, attackers can gain backend access and execute code remotely.

No authentication required to start.
Triggered by manipulating the history plugin.
Risk of backend access and code execution.

Live Threat

Current exploitation, exposure, and threat context

The structure/history plugin in REDAXO core could allow unauthenticated attackers to forge temporary login tokens, potentially leading to unauthorized backend access and code execution. This could affect system data and sensitive information within the REDAXO backend.

Backend access and code execution.
Forging temporary login tokens.
Unauthorized access to system data.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects REAXDO core's structure/history plugin, potentially exposing backend access and code execution capabilities to unauthenticated attackers. Owners of web applications utilizing REAXDO should prioritize identifying all instances of the affected software, assessing their internet reachability and business criticality, and determining the accountable system owner before planning remediation.

Application owners should lead remediation efforts.
Verify internet-facing REAXDO instances first.
Plan coordinated updates during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is REDAXO core?

REDAXO is an open-source content management system used by developers to build and manage dynamic websites. It provides a structured backend environment where administrators can organize content and extend functionality through plugins. The core software handles essential tasks like user authentication and system configuration, ensuring that only authorized personnel can make changes to the site structure or execute administrative commands.

What is the weakness in CVE-2026-117532?

This vulnerability is classified as CWE-287, which refers to improper authentication. In this specific case, the structure/history plugin within REDAXO fails to properly secure the login process. An attacker can manipulate this plugin to force the system to generate predictable temporary credentials. By effectively guessing or forging these tokens, the attacker can masquerade as a legitimate user, such as an administrator, and bypass the normal login requirements.

How is this authentication bypass triggered?

An attacker initiates the process by interacting directly with the structure/history plugin to influence how it manages session-tied secrets. By forcing these secrets into a predictable state, they can create valid-looking login tokens without providing a real password. It is important to note that this flaw does not require the attacker to have pre-existing credentials; the entire bypass occurs through unauthorized manipulation of the plugin's internal state.

Do I need to worry if my REDAXO site is internal?

Yes, you should still be concerned. While Halo Surface Signal notes that REDAXO is typically deployed as a public-facing web presence—making internet-connected instances the most immediate priority—the vulnerability exists within the software itself. Internal applications are still susceptible if an attacker gains access to your private network. You should prioritize internet-facing sites, but treat all instances as potentially affected.

When should I update my REDAXO installation?

You should plan to update your software immediately. Because this vulnerability allows for full backend access and remote code execution, it presents a significant risk to your data and system integrity. Start by auditing your environment to locate all running versions of REDAXO core. Once identified, coordinate with your system owners to apply the necessary updates during your next available maintenance window to secure the administrative interface.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.