Loading vulnerability…
Improper JWT Session Expiration in File Browser Proxy Authentication
CVE-2026-73611 is an insufficient session expiration vulnerability in File Browser affecting versions 2.50.0 through 2.63.21. When JWT-based proxy authentication is configured with a non-default logout page, the application fails to properly validate JWT expiration. As a result, tokens that should be expired may continue to be accepted for access to protected routes, including administrative endpoints. The flaw also affects the token renewal logic, allowing an expired but previously valid token to be exchanged for a fresh token, effectively extending session validity beyond the intended lifetime.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an attacker in possession of a previously valid JWT to bypass intended session expiration controls and maintain unauthorized access to protected application functionality. This can include continued access to administrative endpoints and indefinite session persistence through repeated token renewal, undermining authentication boundaries and prolonging unauthorized access.
If you can’t patch tonight, do this now.
Avoid using the affected proxy authentication configuration with a non-default logout page until patched versions are deployed. Where immediate patching is not possible, reduce exposure through compensating controls such as restricting network access to the application, enforcing authentication and session validation at an upstream proxy or identity layer, and monitoring for suspicious reuse or renewal of expired sessions.
Patch, then assume compromise.
Upgrade File Browser to a version newer than 2.63.21 that includes the vendor's fix. Ensure the patched release correctly enforces JWT expiration checks in proxy authentication flows and prevents renewal of expired tokens.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.