Which versions of Question2Answer are affected by CVE-2026-64829?

Question2Answer versions through 1.8.8 contain a critical authentication bypass where attackers holding stolen persistent 'Remember me' cookies retain account access even after the legitimate owner…

How to fix or mitigate CVE-2026-64829?

Within 24 hours: Inventory all systems running Question2Answer and identify any instances running version 1.8.8 or earlier; document exposure scope and alert security operations to monitor for suspicious authentication activity on affected deployments. Within 7 days: Monitor the upstream Question2Answer GitHub repository for patch availability, test temporary mitigations such as implementing session invalidation hooks triggered on password reset, and prepare patching procedures with rollback plans. Within 30 days: Deploy the vendor-released patch to all affected Question2Answer installations once available, verify that password reset operations properly invalidate the sessioncode field, and conduct regression testing of the account recovery workflow to confirm the authentication bypass is closed.

Question2Answer CVE-2026-64829

Q: What is the CVSS score of CVE-2026-64829?

CVE-2026-64829 has a CVSS 4.0 base score of 9.1 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-47782 CRITICAL

Insufficient Session Expiration (CWE-613)

2026-07-22 disclosure@vulncheck.com

PHP Information Disclosure

9.1

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

9.1 CRITICAL

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.8 MEDIUM

AC:H and UI:R because the attacker needs a pre-stolen persistent cookie and the victim must perform the password reset; PR:N since no normal credentials are used; C:H/I:H for full account access, A:N.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 22, 2026 - 20:39 vuln.today

Analysis Generated

Jul 22, 2026 - 20:39 vuln.today

CVE Published

Jul 22, 2026 - 20:17 cve.org

CRITICAL 9.1

DescriptionCVE.org

Question2Answer through 1.8.8 contains a session invalidation vulnerability that allows attackers with a previously obtained remember-me cookie to retain authenticated access by exploiting the forgot-password reset flow's failure to clear the sessioncode field in qa-include/app/users-edit.php. While the normal password-change flow in qa-include/pages/account.php explicitly clears the sessioncode to invalidate persistent qa_session cookies, the forgot-password handler qa_finish_reset_user() omits this step, allowing any valid persistent cookie issued before the reset to continue authenticating the account after the password reset completes.

Articles & Coverage 2

News 3 New PHP Vulnerabilities - 2 Critical, 1 High Severity Jul 23, 2026 News Critical Authentication Bypass in Question2Answer through 1.8.8 - CVE-2026-64829 Jul 22, 2026

AnalysisAI

Persistent authentication bypass in Question2Answer through 1.8.8 lets an attacker holding a stolen 'Remember me' (qa_session) cookie keep authenticated access to an account even after its password is reset via the forgot-password flow. The reset handler qa_finish_reset_user() fails to clear the user's sessioncode field, so previously issued persistent cookies remain valid - defeating the primary account-recovery defense used after a compromise. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the fix is an upstream GitHub pull request rather than a tagged release.

Technical ContextAI

Question2Answer is an open-source PHP Q&A platform. Its persistent-login ('Remember me') feature issues a qa_session cookie whose validity is anchored to a per-user sessioncode value stored in the database. When that sessioncode is cleared or rotated, all outstanding persistent cookies are invalidated. The normal in-app password change (qa-include/pages/account.php) explicitly resets sessioncode, but the forgot-password reset path (qa_finish_reset_user() in qa-include/app/users-edit.php) omits this step. This maps to CWE-613 (Insufficient Session Expiration): a security-sensitive event (password reset) that should terminate all sessions fails to do so, leaving pre-existing session tokens valid. The upstream fix (PR #1017) simply adds qa_db_user_set($userId, 'sessioncode', '') to the reset function so old persistent logins stop working.

RemediationAI

Upstream fix available (PR/commit); a released patched version was not independently confirmed from the provided data. Apply the change from https://github.com/q2a/question2answer/pull/1017, which adds qa_db_user_set($userId, 'sessioncode', '') inside qa_finish_reset_user() so that a password reset clears the sessioncode and invalidates all outstanding persistent 'Remember me' cookies. Until a tagged release is available, operators can cherry-pick that one-line patch, or as an interim compensating control disable the persistent-login/'Remember me' feature so no long-lived qa_session cookies are issued (trade-off: users must log in each session). For accounts suspected of prior compromise, administratively rotate the affected users' sessioncode values in the database to force-expire existing cookies immediately. Consult the vendor advisory at https://www.vulncheck.com/advisories/question2answer-session-fixation-via-forgot-password-flow for details.