CVE-2026-84203 in Memos
Summary
by MITRE • 09/01/2026
Memos versions 0.26.0 through 0.30.0 fail to revoke refresh tokens when a user changes their password, allowing attackers to maintain account access. An attacker with a stolen refresh token can call the RefreshToken RPC to obtain new access tokens and rotate the refresh token indefinitely, bypassing the password change security measure.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/01/2026
The vulnerability in Memos versions 0.26.0 through 0.30.0 represents a critical authentication flaw rooted in improper session management practices. Specifically, the application fails to invalidate or revoke existing refresh tokens when a user initiates a password change operation. In modern web and API architectures, access tokens are typically short-lived credentials used for immediate authorization requests, while refresh tokens serve as longer-lived mechanisms to obtain new access tokens without requiring repeated authentication by the user. The security model relies on the assumption that changing a password acts as a strong revocation signal, effectively terminating all existing sessions associated with the compromised account. However, in this specific implementation, the backend logic does not trigger the necessary cleanup procedures for active refresh token records upon successful credential modification.
This technical flaw allows an attacker who has previously obtained a valid refresh token through means such as cross-site scripting, network interception, or database exfiltration to maintain persistent access even after the legitimate user changes their password. The core of the issue lies in the RefreshToken RPC endpoint, which accepts and processes existing tokens without verifying whether they have been invalidated due to recent credential updates. Consequently, an attacker can repeatedly call this endpoint using a stolen refresh token to generate new short-lived access tokens. This capability enables indefinite session rotation, effectively bypassing one of the primary defensive measures intended to mitigate account compromise. The system treats all validly formatted and non-expired refresh tokens as equally authoritative, regardless of their temporal relationship with password changes.
The operational impact of this vulnerability is severe, particularly for users who may not immediately detect unauthorized access or who rely on automatic session persistence features common in modern applications. Once an attacker secures a refresh token, they can continue to authenticate and perform actions under the victim's identity indefinitely, provided the token has not reached its absolute expiration date defined by other security policies. This persistent access facilitates long-term data exfiltration, unauthorized modifications, or further lateral movement within systems that trust Memos for authentication delegation. The inability of password changes to sever active sessions undermines user confidence in account recovery mechanisms and exposes organizations to prolonged breach durations where the attacker remains undetected while maintaining a foothold via valid cryptographic credentials.
From an industry standard perspective, this vulnerability aligns with CWE-613, which describes Insufficient Session Expiration, as well as aspects of CWE-287 regarding Improper Authentication. The attack pattern corresponds to MITRE ATT&CK technique T1078, specifically the Valid Accounts subcategory, where adversaries leverage legitimate credentials to maintain access. To mitigate this risk, developers must implement a robust token revocation strategy that is tightly coupled with authentication state changes. This includes maintaining a server-side registry of active refresh tokens or utilizing cryptographic claims within the tokens themselves that can be invalidated upon password updates. Additionally, implementing short-lived refresh token lifecycles and requiring re-authentication for sensitive operations can reduce the window of opportunity for attackers exploiting stale credentials. Immediate patching to version 0.31.0 or later is recommended, as these versions address the session management logic to ensure that credential changes properly invalidate all associated active sessions.