Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.2
CVE-2026-39923: Flarum before 1.8.16: Expired Password Reset Tokens Can Be Reused
CVE-2026-39923
CVE-2026-39923
Summary
Flarum, a discussion forum software, has a security issue that allows hackers to reset passwords for any account, even if the password reset token has expired. This is a serious risk because it could allow unauthorized access to your account or others. To fix this, update Flarum to version 1.8.16 or later.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| flarum | flarum framework | < 1.8.16 |
Original title
Flarum < 1.8.16 Password Reset Token Expiry Bypass via POST /reset
Original description
Flarum before 1.8.16 contains a password reset token expiry bypass vulnerability that allows unauthenticated attackers to reuse expired password reset tokens by submitting them directly to the reset processing endpoint. The SavePasswordController::handle() method calls PasswordToken::findOrFail() without performing any expiry validation, allowing attackers to bypass the 24-hour token lifetime enforced only during form rendering and change any account's password to gain an authenticated session.
nvd CVSS3.1
8.1
nvd CVSS4.0
9.2
Vulnerability type
CWE-324
Published: 5 Aug 2026 · Updated: 5 Aug 2026 · First seen: 5 Aug 2026