q2a Question2Answer up to 1.8.8 Forgot Password users-edit.php qa_finish_reset_user sessioncode session expiration

Summaryinfo

A vulnerability has been found in q2a Question2Answer up to 1.8.8 and classified as critical. This issue affects the function qa_finish_reset_user of the file qa-include/app/users-edit.php of the component Forgot Password. This manipulation of the argument sessioncode causes session expiration. This vulnerability is handled as CVE-2026-64829. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability has been found in q2a Question2Answer up to 1.8.8 and classified as critical. Affected by this vulnerability is the function qa_finish_reset_user of the file qa-include/app/users-edit.php of the component Forgot Password. The manipulation of the argument sessioncode with an unknown input leads to a session expiration vulnerability. The CWE definition for the vulnerability is CWE-613. According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization." As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Question2Answer through 1.8.8 contains a session invalidation vulnerability that allows attackers with a previously obtained remember-me cookie to retain authenticated access by exploiting the forgot-password reset flow's failure to clear the sessioncode field in qa-include/app/users-edit.php. While the normal password-change flow in qa-include/pages/account.php explicitly clears the sessioncode to invalidate persistent qa_session cookies, the forgot-password handler qa_finish_reset_user() omits this step, allowing any valid persistent cookie issued before the reset to continue authenticating the account after the password reset completes.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-64829 since 07/20/2026. The exploitation appears to be easy. The attack can be launched remotely. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available.

By approaching the search of inurl:qa-include/app/users-edit.php it is possible to find vulnerable targets with Google Hacking.

Applying the patch 1017 is able to eliminate this problem.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• q2a

Name

• Question2Answer

Version

• 1.8.0
• 1.8.1
• 1.8.2
• 1.8.3
• 1.8.4
• 1.8.5
• 1.8.6
• 1.8.7
• 1.8.8

Website

• Product: https://github.com/q2a/question2answer/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion