CVE-2026-39923 Details
Description
Flarum before 1.8.16 contains a password reset token expiry bypass vulnerability that allows unauthenticated attackers to reuse expired password reset tokens by submitting them directly to the reset processing endpoint. The SavePasswordController::handle() method calls PasswordToken::findOrFail() without performing any expiry validation, allowing attackers to bypass the 24-hour token lifetime enforced only during form rendering and change any account's password to gain an authenticated session.
A vulnerability in Flarum versions prior to 1.8.16 allows unauthenticated attackers to bypass the expiration limit on password reset tokens. This is achieved by sending expired tokens directly to the password reset processing endpoint. The vulnerability arises because the token validation method used does not check for expiration, enabling the reuse of stale tokens to change passwords and gain unauthorized access to user accounts.
Users can update to Flarum version 1.8.17 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 5, 2026CISA-ADP
Assessed Aug 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/flarum/framework/commit/2803058d0f9dc38252326070b46d4484fe5a857d | [email protected] | Source CodeVendor |
| https://github.com/flarum/framework/pull/4545 | [email protected] | Issue TrackingVendor |
| https://github.com/flarum/framework/releases/tag/v1.8.16 | [email protected] | Release NotesVendor |
| https://www.vulncheck.com/advisories/flarum-password-reset-token-expiry-bypass-via-post-reset | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-324 | Use of a Key Past its Expiration Date | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Flarum | < 1.8.16 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 5, 2026 | CVE Modified | CISA-ADP |
| Aug 5, 2026 | New CVE Received | [email protected] |