SillyTavern up to 1.17.x User Interface change-password session expiration

Summaryinfo

A vulnerability was found in SillyTavern up to 1.17.x. It has been classified as problematic. This vulnerability affects unknown code of the file /api/users/change-password of the component User Interface. The manipulation leads to session expiration. This vulnerability is uniquely identified as CVE-2026-44648. Local access is required to approach this attack. No exploit exists. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in SillyTavern up to 1.17.x. This issue affects an unknown code block of the file /api/users/change-password of the component User Interface. The manipulation with an unknown input leads to a session expiration vulnerability. Using CWE to declare the problem leads to CWE-613. According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization." Impacted is confidentiality, integrity, and availability. The summary by CVE is:

SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to 1.18.0, SillyTavern relies on cookie-session for authentication, storing all session data (user handle, permissions) in a signed cookie. The endpoints POST /api/users/change-password and POST /api/users/recover-step2 only update the password hash in the database but do not expire current sessions. Because the session is stateless and stored entirely in the client cookie, there is no server-side mechanism to revoke a token once issued. This vulnerability is fixed in 1.18.0.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-44648 since 05/07/2026. The exploitation is known to be difficult. An attack has to be approached locally. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available.

Upgrading to version 1.18.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-33402). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• SillyTavern

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17

Website

• Product: https://github.com/SillyTavern/SillyTavern/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion