CVE-2026-0519

In Secure Access 12.70 and prior to 14.20, the logging subsystem may write an unredacted authentication token to logs under certain configurations. Any party with access to those logs could read the token and reuse it to access an integrated system.

CVSS v3 3.4 LOW

3.4^/10

CVSS v3 : LOW

Vector :

Exploitability : 0.8 / Impact : 2.5

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2026-0519	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:absolute:secure_access:*:*:*:*:*:*:*:*

History

17 Jun 2026, 10:10

Type	Values Removed	Values Added
Summary		(es) En Secure Access 12.70 y previo a la 14.20, el subsistema de registro podría escribir un token de autenticación sin redactar en los registros bajo ciertas configuraciones. Cualquier parte con acceso a esos registros podría leer el token y reutilizarlo para acceder a un sistema integrado.

02 Feb 2026, 16:04

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 3.4
First Time		Absolute secure Access Absolute
References	~~() https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2026-0519 -~~	() https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2026-0519 - Vendor Advisory
CPE		cpe:2.3:a:absolute:secure_access::::::::

20 Jan 2026, 19:15

Type	Values Removed	Values Added
CWE		CWE-532

17 Jan 2026, 02:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-01-17 02:15

Updated : 2026-06-17 10:10

NVD link : CVE-2026-0519

Mitre link : CVE-2026-0519

CVE.ORG link : CVE-2026-0519

JSON object : View

Products Affected

absolute

secure_access

CWE

CWE-532

Insertion of Sensitive Information into Log File

{"id": "CVE-2026-0519", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0519", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-20T18:37:55.973582Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.4, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 0.8}], "cvssMetricV40": [{"type": "Secondary", "source": "SecurityResponse@netmotionsoftware.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 4.6, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "SecurityResponse@netmotionsoftware.com", "affectedData": [{"vendor": "Absolute Security", "product": "Secure Access", "versions": [{"status": "affected", "version": "12.70", "lessThan": "14.20", "versionType": "Server"}], "defaultStatus": "unaffected"}]}], "published": "2026-01-17T02:15:49.627", "references": [{"url": "https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2026-0519", "tags": ["Vendor Advisory"], "source": "SecurityResponse@netmotionsoftware.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-532"}]}], "descriptions": [{"lang": "en", "value": "In Secure Access 12.70 and prior to 14.20, the logging \nsubsystem may write an unredacted authentication token to logs under \ncertain configurations. Any party with access to those logs could read \nthe token and reuse it to access an integrated system."}, {"lang": "es", "value": "En Secure Access 12.70 y previo a la 14.20, el subsistema de registro podr\u00eda escribir un token de autenticaci\u00f3n sin redactar en los registros bajo ciertas configuraciones. Cualquier parte con acceso a esos registros podr\u00eda leer el token y reutilizarlo para acceder a un sistema integrado."}], "lastModified": "2026-06-17T10:10:53.003", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:absolute:secure_access:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DB3C9C13-5E04-471A-8CAA-C09B049F420F", "versionEndExcluding": "14.20", "versionStartIncluding": "12.70"}], "operator": "OR"}]}], "sourceIdentifier": "SecurityResponse@netmotionsoftware.com"}