CVE-2026-50000

SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communicate with anonymous sources. From 2.5.0 until 2.16.0, the Journalist Interface can accept an API session token against the web UI because its SessionInterface keeps a mutable session key prefix that changes with each request and persists across requests. API and web sessions were separated in Redis starting in version 2.5.0, but prefix corruption confuses those session namespaces. An attacker who already has access to the secret Journalist Interface onion address, the required authentication access and a recent nonexpired API session token can reuse that token against the web UI until its natural expiry, at most eight hours. The corrupted prefix can also prevent logout from deleting the correct Redis session, although normal expiry still applies. A compromised journalist can access encrypted submissions and perform broad actions on source submissions, but this issue does not expose plaintext submissions or affect the running system's availability. This issue is fixed in version 2.16.0.

SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communicate with anonymous sources. From 2.5.0 until 2.16.0, the Journalist Interface can accept an API session token against the web UI because its SessionInterface keeps a mutable session key prefix that changes with each request and persists across requests. API and web sessions were separated in Redis starting in version 2.5.0, but prefix corruption confuses those session namespaces. An attacker who already has access to the secret Journalist Interface onion address, the required authentication access and a recent nonexpired API session token can reuse that token against the web UI until its natural expiry, at most eight hours. The corrupted prefix can also prevent logout from deleting the correct Redis session, although normal expiry still applies. A compromised journalist can access encrypted submissions and perform broad actions on source submissions, but this issue does not expose plaintext submissions or affect the running system's availability. This issue is fixed in version 2.16.0.

SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communicate with anonymous sources. From 2.5.0 until 2.16.0, the Journalist Interface can accept an API session token against the web UI because its SessionInterface keeps a mutable session key prefix that changes with each request and persists across requests. API and web sessions were separated in Redis starting in version 2.5.0, but prefix corruption confuses those session namespaces. An attacker who already has access to the secret Journalist Interface onion address, the required authentication access and a recent nonexpired API session token can reuse that token against the web UI until its natural expiry, at most eight hours. The corrupted prefix can also prevent logout from deleting the correct Redis session, although normal expiry still applies. A compromised journalist can access encrypted submissions and perform broad actions on source submissions, but this issue does not expose plaintext submissions or affect the running system's availability. This issue is fixed in version 2.16.0.

SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communicate with anonymous sources. From 2.5.0 until 2.16.0, the Journalist Interface can accept an API session token against the web UI because its SessionInterface keeps a mutable session key prefix that changes with each request and persists across requests. API and web sessions were separated in Redis starting in version 2.5.0, but prefix corruption confuses those session namespaces. An attacker who already has access to the secret Journalist Interface onion address, the required authentication access and a recent nonexpired API session token can reuse that token against the web UI until its natural expiry, at most eight hours. The corrupted prefix can also prevent logout from deleting the correct Redis session, although normal expiry still applies. A compromised journalist can access encrypted submissions and perform broad actions on source submissions, but this issue does not expose plaintext submissions or affect the running system's availability. This issue is fixed in version 2.16.0.