Read the docs
TI-2026-28792 Aliases CVE-2026-39923GHSA-3mr9-883x-4f3x

Flarum < 1.8.16 Password Reset Token Expiry Bypass via POST /reset

Priority MEDIUM 42CWE-324Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Flarum before 1.8.16 contains a password reset token expiry bypass vulnerability that allows unauthenticated attackers to reuse expired password reset tokens by submitting them directly to the reset processing endpoint. The SavePasswordController::handle() method calls PasswordToken::findOrFail() without performing any expiry validation, allowing attackers to bypass the 24-hour token lifetime enforced only during form rendering and change any account's password to gain an authenticated session.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00428 37th percentileScored 2026-11-07
Fix Fixed Flarum Framework (Flarum): 1.8.16

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
flarumFlarum Frameworkbefore 1.8.161.8.16Patch availableCNA
  • Flarum Framework Vendorflarum Affected before 1.8.16 Fixed in 1.8.16 Patch available CNA

Remediation

  • Fix · CNA Flarum Framework (Flarum) Fixed in 1.8.16

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Flarum Framework 1.8.16

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-28793 Flarum < 1.8.16 Session Persistence via Improper Access Token RevocationPriority LOW 33
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-39923
  2. 2026-10-03 Alias added: GHSA-3mr9-883x-4f3x

References

Patch 1

Other 2

  • TI-2021-12339 XSS vulnerability with translator CVSS 3.1CRITICAL 10.0
  • TI-2023-08736 Post mentions can be used to read any post on the forum without access control CVSS 3.1HIGH 7.7
  • TI-2025-20573 Flarum Vulnerable to Session Hijacking via Authoritative Subdomain Cookie Overwrite CVSS 3.1MEDIUM 6.8
  • TI-2026-30290 Flarum: Path traversal in LESS parser via theme color settings (incomplete fix for CVE-2023-27577) CVSS 3.1MEDIUM 4.9
  • TI-2026-23739 flarum/nickname: Display name injection in notification emails (autolink & markdown) CVSS 3.1MEDIUM 4.6
  • TI-2022-20279 Cross site scripting vulnerability with discussion titles in flarum CVSS 3.1CRITICAL 9.0
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences