CVE-2026-39924 | BDVDB-2026-355457 Detail

Description#

Flarum before 1.8.16 contains an improper session invalidation vulnerability that allows attackers who hold a valid session token to retain full account access after a victim changes their password, because the access_tokens table is never cleared on password change events. The TokensClearer::clearPasswordTokens() function only removes rows from the password_tokens table while leaving all active session cookies and API bearer tokens intact, including long-lived RememberAccessToken entries, and administrator-forced password resets via the user update endpoint are equally ineffective at revoking attacker-held sessions.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-08-05Record published in the CVE List.
2. Version 22026-11-08Most recent update recorded in the CVE List.