CVE-2026-39923
Received Received - Intake

Password Reset Token Expiry Bypass in Flarum

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: VulnCheck

Description
Flarum before 1.8.16 contains a password reset token expiry bypass vulnerability that allows unauthenticated attackers to reuse expired password reset tokens by submitting them directly to the reset processing endpoint. The SavePasswordController::handle() method calls PasswordToken::findOrFail() without performing any expiry validation, allowing attackers to bypass the 24-hour token lifetime enforced only during form rendering and change any account's password to gain an authenticated session.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-39923
EUVD
EUVD-2026-53389

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
flarum flarum to 1.8.16 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-324 The product uses a cryptographic key or password past its expiration date, which diminishes its safety significantly by increasing the timing window for cracking attacks against that key.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Flarum before 1.8.16 has a flaw where password reset tokens can be reused even after expiration. The POST /reset endpoint did not check if tokens were expired, allowing attackers with old tokens to reset any account's password and gain access.

Detection Guidance

To detect this vulnerability, check if your Flarum instance is running a version prior to 1.8.16. Use the command: curl -s https://your-flarum-instance.com/ | grep -i 'flarum' to identify the version. If the version is below 1.8.16, the system is vulnerable.

Impact Analysis

If you use Flarum before 1.8.16, attackers could take over your account by using an expired password reset token. This could lead to unauthorized access to your data and actions on your behalf.

Compliance Impact

This vulnerability could violate GDPR's requirement for strong authentication and data protection, as unauthorized access may expose personal data. It may also conflict with HIPAA's access controls for protected health information.

Mitigation Strategies

Immediately update Flarum to version 1.8.16 or later. This can be done via Composer with: composer update flarum/framework. After updating, verify the fix by checking the changelog or running the version check command again.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-39923. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart