Description

File Browser versions from 2.50.0 through 2.63.21 fail to validate JWT expiration when proxy authentication is configured with a non-default logout page. Attackers with a previously valid token can access protected routes and administrative endpoints indefinitely, and exchange expired tokens for fresh ones via the renewal endpoint.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-08-13T12:17:25.747Z",
  "pubdate": "2026-08-13T12:17:25.747Z",
  "executiveSummary": "File Browser versions from 2.50.0 through 2.63.21 suffer from an authentication bypass vulnerability characterized by the failure to validate JSON Web Token (JWT) expiration under specific configuration conditions. The vulnerability specifically manifests when proxy authentication is enabled alongside a non-default logout page configuration.\nThe primary impact of this security flaw is unauthorized, indefinite access to protected application routes and administrative endpoints. Threat actors possessing a previously valid token can bypass standard session termination controls and maintain persistent unauthorized access. Furthermore, attackers can leverage the renewal endpoint to cryptographically or logically exchange expired tokens for fresh, valid session tokens.\nThe affected product is File Browser, specifically impacting all deployments utilizing versions 2.50.0 through 2.63.21 with proxy authentication and custom logout settings. The risk implications are severe, as unauthorized entities can interact with administrative interfaces and sensitive file resources without valid, active credentials.\nAttacker capabilities include prolonged session persistence, complete authorization bypass on protected endpoints, and token lifecycle manipulation. Exploitation requirements mandate that the target File Browser instance is configured with proxy authentication and a non-default logout page, and that the attacker has obtained at least one previously valid JWT.",
  "technicalDetails": "The root cause of the vulnerability lies within the session validation logic of File Browser versions 2.50.0 through 2.63.21. When proxy authentication is configured in conjunction with a non-default logout page, the application fails to enforce expiration checks on incoming JSON Web Tokens (JWT).\nThe vulnerable component is responsible for parsing, verifying, and validating session tokens against temporal constraints during incoming HTTP requests to protected routes and administrative endpoints. Due to the logic flaw introduced by the specific proxy authentication and logout page configuration, the validation routine omits the verification of the standard 'exp' (expiration time) claim.\nThe attack flow proceeds as follows: First, an attacker obtains a legitimate JWT, which may occur through normal previous authentication sessions or interception. Second, the token naturally passes its designated expiration time. Third, the attacker transmits requests containing the expired JWT to protected resources or administrative endpoints within a File Browser instance configured with proxy authentication and a non-default logout page. Fourth, because the application fails to validate the token expiration claim under these specific configuration parameters, the request is treated as authenticated. Finally, the attacker interacts with sensitive endpoints indefinitely or submits the expired token to the renewal endpoint to acquire a fresh, valid session token, thereby establishing persistent unauthorized access."
}