CVE-2026-86589: Apache Answer does not revoke sessions after central account suspension

Radar records advisory CVE-2026-86589, posted to the oss-sec feed on 15 October by Enxin Xie and captured by our source on 16 October 2026. The source rates severity as moderate and affects Apache Answer up to version 2.0.2. The flaw is in the authentication logic: when a user signs in through the User Center integration, the new session may not carry the external identity. Later requests can then pass checks that should block suspended or deleted accounts in the central account. The description says the effect lasts while the session remains valid. The text was machine-translated by the source, so technical details should be confirmed in the original. To verify, consult the original advisory linked in the source on the oss-sec archive, compare it with the official CVE record and the Apache Answer release notes. Confirm your installed version before taking any action.