CyberRota Analysis
AI-GeneratedFlarum versions prior to 1.8.16 are vulnerable due to improper session invalidation, allowing attackers with valid session tokens to maintain access even after a victim changes their password. This flaw results from the failure to clear active session cookies and API bearer tokens during password changes, posing a risk of unauthorized account access. Organizations using Flarum should prioritize this update to mitigate potential account compromise risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Flarum before 1.8.16 contains an improper session invalidation vulnerability that allows attackers who hold a valid session token to retain full account access after a victim changes their password, because the access_tokens table is never cleared on password change events. The TokensClearer::clearPasswordTokens() function only removes rows from the password_tokens table while leaving all active session cookies and API bearer tokens intact, including long-lived RememberAccessToken entries, and administrator-forced password resets via the user update endpoint are equally ineffective at revoking attacker-held sessions.