CVE-2021-3311

An issue was discovered in October through build 471. It reactivates an old session ID (which had been invalid after a logout) once a new login occurs. NOTE: this violates the intended Auth/Manager.php authentication behavior but, admittedly, is only relevant if an old session ID is known to an attacker.

• CWE-613

• https://anisiosantos.me/october-cms-token-reactivationExploit, Third Party Advisory
• https://github.com/octobercms/library/commit/642f597489e6f644d4bd9a0c267e864cabead024Patch, Third Party Advisory
• https://octobercms.com/forum/chan/announcementsVendor Advisory
• https://anisiosantos.me/october-cms-token-reactivationExploit, Third Party Advisory
• https://github.com/octobercms/library/commit/642f597489e6f644d4bd9a0c267e864cabead024Patch, Third Party Advisory
• https://octobercms.com/forum/chan/announcementsVendor Advisory

Published

Feb 5, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-33104Improper access control in the Intel(R) OFU software before …5.5
• CVE-2021-33105Out-of-bounds read in some Intel(R) Core(TM) processors with…5.5
• CVE-2021-33106Integer overflow in the Safestring library maintained by Int…7.8
• CVE-2021-33107Insufficiently protected credentials in USB provisioning for…4.6
• CVE-2021-33108Improper input validation in the Intel(R) In-Band Manageabil…6.7
• CVE-2021-33109Rejected reason: This is unused.
• CVE-2021-33110Improper input validation for some Intel(R) Wireless Bluetoo…6.5
• CVE-2021-33111Rejected reason: This is unused.
• CVE-2021-33112Rejected reason: This is unused.
• CVE-2021-33113Improper input validation for some Intel(R) PROSet/Wireless …8.1
• CVE-2021-33114Improper input validation for some Intel(R) PROSet/Wireless …5.7
• CVE-2021-33115Improper input validation for some Intel(R) PROSet/Wireless …8.8