CVE-2026-1836 — Stored credentials in Redmine

CVE-2026-1836

Stored credentials in Redmine PUBLISHED

Description (CNA)

The system stores the username and password from the login form after submitting the request. This could allow an attacker with access to the platform to return to the browser and view the login credentials.

Affected (CNA)

Vendor / product	Versions
Redmine / Redmine	affected 0 before 6.0.7; affected 0 before 5.1.10; affected 0 before 5.0.14; unaffected 6.0.7; unaffected 5.1.10; unaffected 5.0.14

CWE

CWE-257

References

https://www.incibe.es/en/incibe-cert/notices/aviso/stored-credentials-redmine

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.