Description
Flarum before 1.8.16 contains a password reset token expiry bypass vulnerability that allows unauthenticated attackers to reuse expired password reset tokens by submitting them directly to the reset processing endpoint. The SavePasswordController::handle() method calls PasswordToken::findOrFail() without performing any expiry validation, allowing attackers to bypass the 24-hour token lifetime enforced only during form rendering and change any account-s password to gain an authenticated session.
CVSS 8.1EPSS 0.26%Risque 0.83
Voir la source- Publication
- 2026-08-05 16:16:55
- Dernière modification
- 2026-08-05 20:17:08
- Vecteur
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H