CVE-2026-39923 | BDVDB-2026-355456 Detail

Description#

Flarum before 1.8.16 contains a password reset token expiry bypass vulnerability that allows unauthenticated attackers to reuse expired password reset tokens by submitting them directly to the reset processing endpoint. The SavePasswordController::handle() method calls PasswordToken::findOrFail() without performing any expiry validation, allowing attackers to bypass the 24-hour token lifetime enforced only during form rendering and change any account's password to gain an authenticated session.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-08-05Record published in the CVE List.
2. Version 22026-11-08Most recent update recorded in the CVE List.