CyberRota Analysis
AI-GeneratedFlarum versions prior to 1.8.16 are vulnerable to a password reset token expiry bypass, enabling unauthenticated attackers to reuse expired tokens and change any account's password without proper validation. This flaw arises from the SavePasswordController::handle() method, which fails to check token expiry during processing. Organizations using affected versions should prioritize patching to mitigate the risk of unauthorized account access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Flarum before 1.8.16 contains a password reset token expiry bypass vulnerability that allows unauthenticated attackers to reuse expired password reset tokens by submitting them directly to the reset processing endpoint. The SavePasswordController::handle() method calls PasswordToken::findOrFail() without performing any expiry validation, allowing attackers to bypass the 24-hour token lifetime enforced only during form rendering and change any account's password to gain an authenticated session.