CVE-2026-39923 json
Flarum < 1.8.16 Password Reset Token Expiry Bypass via POST /reset
published 3mo ago modified yesterday also EUVD-2026-53389
- cvss
- 8.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 37%
- public exploits
- 0
- none known
Summary
Flarum before 1.8.16 contains a password reset token expiry bypass vulnerability that allows unauthenticated attackers to reuse expired password reset tokens by submitting them directly to the reset processing endpoint. The SavePasswordController::handle() method calls PasswordToken::findOrFail() without performing any expiry validation, allowing attackers to bypass the 24-hour token lifetime enforced only during form rendering and change any account's password to gain an authenticated session.
Patch / fix
- Flarum Flarum Framework 1.8.16
- github.com/flarum/framework@2803058 commit
- github.com/flarum/framework#4545 pull request
- github.com/flarum/framework/releases/tag/v1.8.16 release
Is CVE-2026-39923 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 3mo ago
Exploit prediction
0.43% chance of exploitation in the next 30 days, higher than 37% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 9.2 | CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| CNA | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 4.0 | 9.2 | CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- Flarum Flarum Framework
Classification
- Weakness
-
- CWE-324 Use of a Key Past its Expiration Date
References
-
github.com
/flarum/framework/pull/4545
issue-tracking, patch
-
github.com
/flarum/framework/commit/2803058d0f9dc38252326070b46d4484fe5a857d
patch
-
github.com
/flarum/framework/releases/tag/v1.8.16
release-notes
-
vulncheck.com
/advisories/flarum-password-reset-token-expiry-bypass-via-post-reset
third-party-advisory
Sources
- CVE List CVE-2026-39923
- NVD CVE-2026-39923
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.