Flarum Framework
Monthly
Session persistence after password change in Flarum before 1.8.16 allows an attacker who already holds a valid session token to maintain full account access indefinitely, even after the victim resets their password. The `TokensClearer::clearPasswordTokens()` function clears only the `password_tokens` table and never touches the `access_tokens` table, so all active session cookies, API bearer tokens, and long-lived RememberAccessToken entries survive both user-initiated and administrator-forced password resets. No public exploit has been identified at time of analysis; vendor-released patch v1.8.16 resolves the issue.
Account takeover in Flarum forum software before 1.8.16 lets remote unauthenticated attackers reuse expired password reset tokens by POSTing them directly to the reset endpoint, bypassing the 24-hour token lifetime that is only enforced when the reset form is rendered. Because SavePasswordController::handle() calls PasswordToken::findOrFail() with no expiry check, anyone holding a stale-but-still-existing token can set a new password and log in as that user. Reported by VulnCheck; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Session persistence after password change in Flarum before 1.8.16 allows an attacker who already holds a valid session token to maintain full account access indefinitely, even after the victim resets their password. The `TokensClearer::clearPasswordTokens()` function clears only the `password_tokens` table and never touches the `access_tokens` table, so all active session cookies, API bearer tokens, and long-lived RememberAccessToken entries survive both user-initiated and administrator-forced password resets. No public exploit has been identified at time of analysis; vendor-released patch v1.8.16 resolves the issue.
Account takeover in Flarum forum software before 1.8.16 lets remote unauthenticated attackers reuse expired password reset tokens by POSTing them directly to the reset endpoint, bypassing the 24-hour token lifetime that is only enforced when the reset form is rendered. Because SavePasswordController::handle() calls PasswordToken::findOrFail() with no expiry check, anyone holding a stale-but-still-existing token can set a new password and log in as that user. Reported by VulnCheck; no public exploit identified at time of analysis, and it is not listed in CISA KEV.