CVE-2026-39923

Publié : 5 août 2026

Modifié : 5 août 2026

Score CVSS

8.1

HIGH

Description détaillée

Flarum before 1.8.16 contains a password reset token expiry bypass vulnerability that allows unauthenticated attackers to reuse expired password reset tokens by submitting them directly to the reset processing endpoint. The SavePasswordController::handle() method calls PasswordToken::findOrFail() without performing any expiry validation, allowing attackers to bypass the 24-hour token lifetime enforced only during form rendering and change any account's password to gain an authenticated session.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Références et Patchs

https://github.com/flarum/framework/commit/2803058d0f9dc38252326070b46d4484fe5a857d https://github.com/flarum/framework/pull/4545 https://github.com/flarum/framework/releases/tag/v1.8.16 https://www.vulncheck.com/advisories/flarum-password-reset-token-expiry-bypass-via-post-reset

Dernières Vulnérabilités

CVE-2026-9077

IBM Langflow OSS 1.0.0 through 1.10.3 Langflow allows remote authenticated attackers to bypass localhost-only restrictions and write arbitrary MCP server configurations to IDE configuration files on the host system.

VOIR DÉTAILS

CVE-2026-8446

IBM Langflow OSS 1.0.0 through 1.10.3 contain an authentication bypass vulnerability in the Model Context Protocol (MCP) composer endpoint when mcp_composer_enabled=true (default) and projects are configured with auth_type=oauth .

VOIR DÉTAILS

CVE-2026-7646

IBM Langflow OSS 1.0.0 through 1.10.3 allows users to read arbitrary files from the server filesystem, including other users' uploaded documents, the JWT signing secret, the SQLite database, and process environment variables, by sending a crafted MCP `resources/read` request with a URL-encoded path traversal sequence in the filename.

VOIR DÉTAILS