Read the docs
TI-2026-00891 Aliases CVE-2026-1163GHSA-8jg2-726g-xh43

Insufficient Session Expiration in parisneo/lollms

Priority MEDIUM 52CWE-613Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · Low
Fix status
No fix listed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-613.

Summary

An insufficient session expiration vulnerability exists in the latest version of parisneo/lollms. The application fails to invalidate active sessions after a password reset, allowing an attacker to continue using an old session token. This issue arises due to the absence of logic to reject requests after a period of inactivity and the excessively long default session duration of 31 days. The vulnerability enables an attacker to maintain persistent access to a compromised account, even after the victim resets their password.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00216 12th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
parisneoparisneo/lollmsup to latest—No fix listedCNA
—lollms (PyPI)up to 11.0.0—No fix listedGHSA-8jg2-726g-xh43
  • parisneo/lollms Vendorparisneo Affected up to latest Fixed in — No fix listed CNA
  • lollms (PyPI) Vendor— Affected up to 11.0.0 Fixed in — No fix listed GHSA-8jg2-726g-xh43

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-1163
  2. 2026-10-03 Alias added: GHSA-8jg2-726g-xh43

References

Advisory 1

Other 2

  • TI-2026-00842 Improper Access Control via Weak JWT Token in parisneo/lollms CVSS 3.0CRITICAL 9.8
  • TI-2024-05059 Remote Code Execution via Path Traversal in parisneo/lollms CVSS 3.0CRITICAL 9.8
  • TI-2024-04029 Remote Code Execution via `/apply_settings` and `/execute_code` in parisneo/lollms-webui CVSS 3.0CRITICAL 9.8
  • TI-2024-04023 Remote Code Execution due to LFI in '/install_extension' in parisneo/lollms-webui CVSS 3.1CRITICAL 9.8
  • TI-2024-03798 Arbitrary Code Execution in parisneo/lollms CVSS 3.0CRITICAL 9.8
  • TI-2024-02196 Arbitrary Upload & Read via Path Traversal in parisneo/lollms-webui CVSS 3.0CRITICAL 9.6
See all 83 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences