CVE-2026-63400 Details
Description
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, `resetPasswordForToken` updates the password row without invalidating database-backed sessions. An attacker who has acquired a password and established a session retains access even after the legitimate user resets the password, leaving the compromised account under attacker control until the session expires at its `30-day` maximum age. This issue is fixed in version 1.0.2.
A vulnerability in Roost Coop versions prior to 1.0.2 allows sessions to persist after a password reset, failing to invalidate database-backed sessions. This issue enables an attacker who has obtained a password and established a session to maintain access to the account until the session expires, which can be up to 30 days. The vulnerability arises because the `resetPasswordForToken` function updates the password without clearing active sessions, leaving compromised accounts under the attacker's control.
This vulnerability has been addressed in Roost Coop version 1.0.2, which invalidates sessions on password changes. Users should update to this version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/roostorg/coop/commit/f226db0fb7f03096d2a832304ad9614e944e4bf8 | [email protected] | Source CodeVendor |
| https://github.com/roostorg/coop/pull/778 | [email protected] | Source CodeVendor |
| https://github.com/roostorg/coop/releases/tag/1.0.2 | [email protected] | Release NotesVendor |
| https://github.com/roostorg/coop/security/advisories/GHSA-g5xq-67g7-36r2 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-613 | Insufficient Session Expiration | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ROOST Coop | < 1.0.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2026 | New CVE Received | [email protected] |