CVE-2026-73611

EUVD-2026-57815
File Browser versions from 2.50.0 through 2.63.21 fail to validate JWT expiration when proxy authentication is configured with a non-default logout page. Attackers with a previously valid token can access protected routes and administrative endpoints indefinitely, and exchange expired tokens for fresh ones via the renewal endpoint.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
6.8 MEDIUM
NETWORK
HIGH
LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 38.16%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
filebrowserfilebrowser
2.50.0 ≤
𝑥
≤ 2.63.21
CNA
Common Weakness Enumeration
References
https://github.com/filebrowser/filebrowser/commit/72faf6dd3c85628e332d3e567124b86708ce2695
https://github.com/filebrowser/filebrowser/security/advisories/GHSA-v3jv-rmh2-635j
https://www.vulncheck.com/advisories/file-browser-through-jwt-expiration-bypass
https://github.com/filebrowser/filebrowser/security/advisories/GHSA-v3jv-rmh2-635j