Flarum up to 1.8.15 Session Invalidation clearPasswordTokens session expiration

Summaryinfo

A vulnerability was found in Flarum up to 1.8.15. It has been declared as critical. This impacts the function TokensClearer::clearPasswordTokens of the component Session Invalidation. Such manipulation leads to session expiration. This vulnerability is uniquely identified as CVE-2026-39924. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability was found in Flarum up to 1.8.15. It has been rated as critical. Affected by this issue is the function TokensClearer::clearPasswordTokens of the component Session Invalidation. The manipulation with an unknown input leads to a session expiration vulnerability. Using CWE to declare the problem leads to CWE-613. According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization." Impacted is confidentiality, integrity, and availability. CVE summarizes:

Flarum before 1.8.16 contains an improper session invalidation vulnerability that allows attackers who hold a valid session token to retain full account access after a victim changes their password, because the access_tokens table is never cleared on password change events. The TokensClearer::clearPasswordTokens() function only removes rows from the password_tokens table while leaving all active session cookies and API bearer tokens intact, including long-lived RememberAccessToken entries, and administrator-forced password resets via the user update endpoint are equally ineffective at revoking attacker-held sessions.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-39924 since 04/07/2026. The exploitation is known to be easy. The attack may be launched remotely. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available.

Upgrading to version 1.8.16 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• Flarum

Version

• 1.8.0
• 1.8.1
• 1.8.2
• 1.8.3
• 1.8.4
• 1.8.5
• 1.8.6
• 1.8.7
• 1.8.8
• 1.8.9
• 1.8.10
• 1.8.11
• 1.8.12
• 1.8.13
• 1.8.14
• 1.8.15

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion