CVE-2026-74037 - Wazuh 4.0.0 before 4.14.8 Session Invalidation Bypass in check_token
CVE ID :CVE-2026-74037 Published : Oct. 13, 2026, 2:17 p.m. | 1 hour, 14 minutes ago Description :Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for run_as users with zero static roles, because check_token never consults the blacklist. Attackers with revoked administrator grants...