CVE-2026-44511

Katalyst Koi is a framework for building Rails admin functionality. Prior to 4.20.0 and 5.6.0, admin session cookies were not invalidated when an admin user logged out. An attacker with access to a valid admin session cookie could continue to access admin functionality after logout, until the cookie expired or session secrets were rotated. This vulnerability is fixed in 4.20.0 and 5.6.0.

• CWE-613

• https://github.com/katalyst/koi/security/advisories/GHSA-4cx3-3c38-j9vv

Published

May 14, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44505Nimiq is a Rust implementation of the Nimiq Proof-of-Stake p…5.3
• CVE-2026-44507Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-44508Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-44509Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-4451Insufficient validation of untrusted input in Navigation in …8.8
• CVE-2026-44510Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-44512Open Neural Network Exchange (ONNX) is an open standard for …5.5
• CVE-2026-44513Diffusers is the a library for pretrained diffusion models.…8.8
• CVE-2026-44514Kubetail is a real-time logging dashboard for Kubernetes. Pr…6.5
• CVE-2026-44515Nextcloud News is an RSS/Atom feed reader. Prior to 28.3.0-b…2.3
• CVE-2026-44516Valtimo is an open-source business process automation platfo…7.6
• CVE-2026-44518liboqs is a C-language cryptographic library that provides i…5.3