What is GHSA-hp5g-5g9f-49wq?

GHSA-hp5g-5g9f-49wq is a security advisory published by GitHub Security Advisories with Critical severity. In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus,...

Which CVE IDs does GHSA-hp5g-5g9f-49wq cover?

GHSA-hp5g-5g9f-49wq covers the following CVE IDs: CVE-2026-11374. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-hp5g-5g9f-49wq?

GHSA-hp5g-5g9f-49wq has a CVSS v3 base score of 9.0, published by GitHub Security Advisories.

GHSA-hp5g-5g9f-49wqCriticalCVSS 9.0

In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus,...

Vendor

GitHub Security Advisories

Published

June 23, 2026

Last Modified

June 23, 2026

🔗 CVE IDs covered (1)

CVE-2026-11374 →

📋 Description

In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the SSO tickets generated to authenticate that session could be predicted by an unauthenticated user, leading to account takeover.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-11374
https://www.manageengine.com/products/self-service-password/advisory/CVE-2026-11374.html
https://github.com/advisories/GHSA-hp5g-5g9f-49wq