SEPTEMBER 20, 2026
Live Feed
Back to database
Case File

CVE-2026-64829

HIGH · CVSS 7.4 EPSS 0.32% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-07-22 · Last synced 2026-08-21

CyberRota Analysis

AI-Generated

The vulnerability allows attackers to maintain authenticated access to Question2Answer systems by exploiting a flaw in the forgot-password reset process, which fails to invalidate the sessioncode associated with previously issued remember-me cookies. This oversight means that even after a password reset, an attacker can continue to access the account if they possess a valid persistent cookie. Organizations using Question2Answer versions up to 1.8.8 should prioritize remediation to prevent unauthorized access to user accounts.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Detected Signals
exploit
GitHub PoC Links

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-64829
Severity
HIGH
CVSS
7.4
EPSS
0.32%

Original NVD Description

Question2Answer through 1.8.8 contains a session invalidation vulnerability that allows attackers with a previously obtained remember-me cookie to retain authenticated access by exploiting the forgot-password reset flow's failure to clear the sessioncode field in qa-include/app/users-edit.php. While the normal password-change flow in qa-include/pages/account.php explicitly clears the sessioncode to invalidate persistent qa_session cookies, the forgot-password handler qa_finish_reset_user() omits this step, allowing any valid persistent cookie issued before the reset to continue authenticating the account after the password reset completes.