CVE-2026-63400

Received Received - Intake

Session Fixation in Coop After Password Reset

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: GitHub, Inc.

Description

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, `resetPasswordForToken` updates the password row without invalidating database-backed sessions. An attacker who has acquired a password and established a session retains access even after the legitimate user resets the password, leaving the compromised account under attacker control until the session expires at its `30-day` maximum age. This issue is fixed in version 1.0.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-30

Last Modified

2026-10-30

Generated

2026-10-31

AI Q&A

2026-10-31

EPSS Evaluated

N/A

NVD

CVE-2026-63400

Affected Vendors & Products

Vendor	Product	Version / Range
roostorg	coop	< 1.0.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-613	According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Attack-Flow Graph

Executive Summary

This vulnerability is in Coop, an open source review and moderation tool. It allows an attacker who already has a user's password and an active session to retain access even after the user resets their password. The flaw occurs because the password reset function does not invalidate existing database-backed sessions, which can last up to 30 days.

Detection Guidance

This vulnerability cannot be directly detected via network or system commands as it involves a session management flaw in the Coop application. Check if your Coop instance is running version 1.0.2 or later. If not, it is vulnerable.

Impact Analysis

If you use Coop versions before 1.0.2, an attacker with temporary access to your account could maintain control indefinitely until your session expires. This means they could continue to misuse your account even after you change your password.

Mitigation Strategies

Upgrade Coop to version 1.0.2 or later immediately to fix the session invalidation issue. Review active sessions for suspicious activity and manually terminate any sessions that may have been compromised.

Hi! I’m here to help you understand CVE-2026-63400. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70