TI-2026-32548 Aliases CVE-2026-44648 GHSA-wmm3-h9qj-p5v6

SillyTavern: Existing sessions are not invalidated after password change, allowing session reuse and account takeover

HIGH 68CWE-613Published 2026-05-29 · Updated 2026-05-29

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: High
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-613.

Summary

SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to 1.18.0, SillyTavern relies on cookie-session for authentication, storing all session data (user handle, permissions) in a signed cookie. The endpoints POST /api/users/change-password and POST /api/users/recover-step2 only update the password hash in the database but do not expire current sessions. Because the session is stateless and stored entirely in the client cookie, there is no server-side mechanism to revoke a token once issued. This vulnerability is fixed in 1.18.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00394 33rd percentileScored 2026-11-07

Fix Fixed SillyTavern (SillyTavern): 1.18.0sillytavern (npm): 1.18.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
SillyTavern	SillyTavern	before 1.18.0	1.18.0	Patch available	CNA
—	sillytavern (npm)	before 1.18.0	1.18.0	Patch available	GHSA-wmm3-h9qj-p5v6

SillyTavern VendorSillyTavern Affected before 1.18.0 Fixed in 1.18.0 Patch available CNA
sillytavern (npm) Vendor— Affected before 1.18.0 Fixed in 1.18.0 Patch available GHSA-wmm3-h9qj-p5v6

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:sillytavern:sillytavern::::::::	—	—	SillyTavern

cpe:2.3:a:sillytavern:sillytavern:*:*:*:*:*:*:*:* Versions — — ·SillyTavern

Remediation

Fix · CNA SillyTavern (SillyTavern) Fixed in 1.18.0
Fix · GHSA-wmm3-h9qj-p5v6 sillytavern (npm) Fixed in 1.18.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-44648
2026-10-03 Alias added: GHSA-wmm3-h9qj-p5v6

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-44648

Other 3

TI-2026-32549 SillyTavern: Authentication Bypass via SSO Header Injection CVSS 3.1CRITICAL 9.8
TI-2026-32550 SillyTavern: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CVSS 3.1CRITICAL 9.1
TI-2025-36763 SillyTavern Web Interface Vulnerable to DNS Rebinding CVSS 3.1CRITICAL 9.7
TI-2026-26773 Path traversal in SillyTavern CVSS 3.1HIGH 8.8
TI-2026-34089 SillyTavern: SSRF in SearXNG Search Proxy via Unvalidated baseUrl CVSS 3.1HIGH 8.5
TI-2026-70544 Pre-authentication denial of service in SillyTavern via body parsing CVSS 4.0HIGH 8.2

See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences