CVE-2026-3269 Details

A denial-of-service vulnerability has been identified in Psi Probe versions through 5.3.0. The issue arises in the Session Handler component, specifically within the ExpireSessionsController.java file, in the handleRequestInternal function. This vulnerability allows authenticated users with the 'probeuser' role to terminate multiple user sessions simultaneously through the '/app/expire_list.htm' endpoint. The application processes these bulk session expiration requests without validating session ownership, enabling low-privileged users to log out multiple users across different web applications with a single request.

It is recommended to implement ownership validation and access controls in the ExpireSessionsController. Additionally, adding security constraints in the web.xml file to restrict bulk operations to users with administrative privileges could help mitigate this vulnerability.