CVE-2026-64829
Received Received - Intake

Session Invalidation Flaw in Question2Answer

Publication date: 2026-07-22

Last updated on: 2026-07-22

Assigner: VulnCheck

Description
Question2Answer through 1.8.8 contains a session invalidation vulnerability that allows attackers with a previously obtained remember-me cookie to retain authenticated access by exploiting the forgot-password reset flow's failure to clear the sessioncode field in qa-include/app/users-edit.php. While the normal password-change flow in qa-include/pages/account.php explicitly clears the sessioncode to invalidate persistent qa_session cookies, the forgot-password handler qa_finish_reset_user() omits this step, allowing any valid persistent cookie issued before the reset to continue authenticating the account after the password reset completes.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-22
Last Modified
2026-07-22
Generated
2026-07-23
AI Q&A
2026-07-22
EPSS Evaluated
N/A
NVD
CVE-2026-64829
EUVD
EUVD-2026-47782

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
question2answer question2answer 1.8.8

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-613 According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-64829 is a session invalidation vulnerability in Question2Answer through version 1.8.8. It allows attackers with a previously obtained remember-me cookie to retain authenticated access even after a password reset. The forgot-password reset flow fails to clear the sessioncode field, unlike the normal password-change flow which properly invalidates sessions.

Detection Guidance

To detect this vulnerability, inspect the forgot-password reset flow in Question2Answer 1.8.8 for the sessioncode field not being cleared. Check logs for qa_finish_reset_user() calls that fail to invalidate qa_session cookies. Look for persistent remember-me tokens that remain valid after password resets.

Impact Analysis

If you use Question2Answer 1.8.8 or earlier, an attacker with an old remember-me cookie could regain access to your account even after you reset your password. This could lead to unauthorized actions, data theft, or account takeover if the remember-me cookie was previously compromised.

Compliance Impact

This vulnerability could violate compliance requirements that mandate timely session termination and access control, such as GDPR's data protection principles or HIPAA's safeguards for protected health information. Unauthorized persistent access may lead to data breaches or unauthorized disclosures.

Mitigation Strategies

Apply the patch from the GitHub pull request #1017 to ensure sessioncode is cleared during password resets. Update to the latest version of Question2Answer. Manually invalidate all existing persistent sessions by clearing qa_session cookies and remember-me tokens.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64829. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart