Coop CVE-2026-63400

Exploitation requires that the attacker has already compromised the account out-of-band - specifically, acquired the victim's password AND established an authenticated, database-backed Coop session - BEFORE the legitimate user performs a password reset. The flaw (resetPasswordForToken updating the password row without clearing stored sessions) then causes that pre-existing session to survive the reset. Key limiting factors: it provides no initial access on its own (PR:L, prior compromise mandatory), it only manifests when the victim actually performs the reset recovery action (AT:P), and the surviving session is self-limiting because sessions carry a 30-day maximum age after which access is lost regardless. There is no unauthenticated or default-configuration remote attack path.

This is a genuinely low-priority issue, and the signals are consistent rather than conflicting. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N) scores only 2.3, and the vuln.today decision label is 'monitor' - not act_now or emergency. The defining constraint is PR:L combined with AT:P: exploitation is not a standalone network attack but a post-compromise persistence weakness. The attacker must ALREADY hold the victim's password and an established session before the flaw has any value; it then merely lets that pre-existing session outlive the password reset the victim performs to recover. It is not in CISA KEV (not confirmed actively exploited), no EPSS score was supplied, and no public exploit was identified. Impact is bounded - the vendor rated only VC:L (limited confidentiality), with no integrity or availability impact, and the stale session self-expires at the 30-day database max age. In short, this is a correct and legitimate CWE-613 finding, but it is a low-real-risk defense-in-depth gap, not a high-CVSS-but-low-risk inflation case and not a widespread exploitation threat; prioritize it as routine patching.

An attacker who has already phished or otherwise obtained a Coop user's password logs in and establishes a database-backed session. The legitimate user later notices or suspects compromise and resets their password, reasonably expecting this to log the attacker out. Because resetPasswordForToken updates the password row without invalidating existing sessions, the attacker's session keeps working, retaining account control until it naturally expires at the 30-day maximum age. No public exploit was identified at time of analysis.