CVE-2026-64829 in Question2Answer
Summary
by MITRE • 07/22/2026
Question2Answer through 1.8.8 contains a session invalidation vulnerability that allows attackers with a previously obtained remember-me cookie to retain authenticated access by exploiting the forgot-password reset flow's failure to clear the sessioncode field in qa-include/app/users-edit.php. While the normal password-change flow in qa-include/pages/account.php explicitly clears the sessioncode to invalidate persistent qa_session cookies, the forgot-password handler qa_finish_reset_user() omits this step, allowing any valid persistent cookie issued before the reset to continue authenticating the account after the password reset completes.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/08/2026
This vulnerability represents a critical session management flaw that undermines the security of authentication mechanisms in Question2Answer versions through 1.8.8. The issue stems from an inconsistent approach to session invalidation during password reset operations, creating a persistent access vector that persists even after legitimate account recovery procedures. The vulnerability specifically affects the remember-me functionality and demonstrates a fundamental weakness in how the application handles session termination across different authentication pathways. Attackers can exploit this by obtaining a valid remember-me cookie and then initiating a password reset through the forgot-password flow, thereby maintaining unauthorized access to accounts despite the password change. This flaw directly violates security principle of least privilege and proper session lifecycle management, as it allows attackers to bypass intended authentication controls.
The technical implementation of this vulnerability occurs within the qa-include/app/users-edit.php file where the sessioncode field fails to be cleared during the forgot-password reset process. The normal password-change flow in qa-include/pages/account.php properly implements session invalidation by explicitly clearing the sessioncode field, which effectively invalidates persistent qa_session cookies and forces users to re-authenticate. However, the qa_finish_reset_user() function omits this crucial step, creating a security gap where previously issued persistent cookies remain valid even after password reset operations complete. This inconsistency creates a race condition where legitimate account recovery procedures are undermined by the persistence of stale session identifiers. The vulnerability operates at the application logic level and represents a classic case of improper session handling that can be classified under CWE-613.
The operational impact of this vulnerability extends beyond simple unauthorized access to encompass potential data breaches, account takeovers, and credential compromise scenarios. Attackers who obtain remember-me cookies through various means such as network sniffing, client-side attacks, or social engineering can maintain persistent access to compromised accounts even after victims reset their passwords. This creates a false sense of security for users who believe they have secured their accounts through password changes, while attackers continue to operate under legitimate user identities. The vulnerability affects the integrity and confidentiality of user data, as unauthorized individuals can access private communications, personal information, and potentially perform administrative actions within the application. This represents a significant threat to user privacy and system security, particularly in environments where Question2Answer serves as a platform for sensitive community interactions.
Security mitigations for this vulnerability require immediate patching of the affected versions to ensure consistent session invalidation across all authentication pathways. The fix must implement proper session code clearing in the qa_finish_reset_user() function to align with the behavior of the normal password-change flow. Organizations should also consider implementing additional security controls such as session monitoring, account activity logging, and multi-factor authentication to reduce the attack surface. Regular security audits should verify that all authentication flows properly handle session invalidation and that no similar inconsistencies exist in other parts of the application. The vulnerability highlights the importance of maintaining consistent security practices throughout software applications and demonstrates why comprehensive testing of authentication flows is essential. From an ATT&CK perspective, this vulnerability maps to T1531 and T1078, representing credential access and valid accounts respectively, while the session management flaw aligns with T1562 which covers application spoofing and session hijacking techniques.