CVE-2026-39924
Received Received - Intake

Improper Session Invalidation in Flarum

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: VulnCheck

Description
Flarum before 1.8.16 contains an improper session invalidation vulnerability that allows attackers who hold a valid session token to retain full account access after a victim changes their password, because the access_tokens table is never cleared on password change events. The TokensClearer::clearPasswordTokens() function only removes rows from the password_tokens table while leaving all active session cookies and API bearer tokens intact, including long-lived RememberAccessToken entries, and administrator-forced password resets via the user update endpoint are equally ineffective at revoking attacker-held sessions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-39924
EUVD
EUVD-2026-53392

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
flarum flarum to 1.8.16 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-613 According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Flarum versions before 1.8.16 have a flaw where session tokens are not properly invalidated when a user changes their password. Attackers with a valid session token can maintain access even after the victim updates their password because the system fails to clear active session tokens like RememberAccessToken entries.

Detection Guidance

To detect this vulnerability, check if Flarum versions before 1.8.16 are installed. Run: flarum --version or check the version in the admin panel. If vulnerable, sessions persist after password changes. Review access_tokens table for active tokens after password resets. Use database queries to verify if clearAccessTokens is implemented.

Impact Analysis

If an attacker gains access to your session token, they can retain full control of your account even after you change your password. This includes accessing sensitive data, performing actions on your behalf, and maintaining persistence in your account.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles and HIPAA's security requirements for safeguarding protected health information. Organizations may face compliance violations and penalties due to insufficient session invalidation.

Mitigation Strategies

Upgrade Flarum to version 1.8.16 or later to address the improper session invalidation issue. Review active sessions and tokens after password changes to ensure no unauthorized access remains.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-39924. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart