CVE-2026-64829

Name of the Vulnerable Software and Affected Versions Question2Answer versions prior to 1.8.9

Description A session invalidation issue exists where the forgot-password reset flow fails to clear the sessioncode field in the file qa-include/app/users-edit.php. While the standard password-change process in qa-include/pages/account.php correctly invalidates persistent qa session cookies, the qa finish reset user() function does not perform this action. This allows an attacker who possesses a previously obtained remember-me cookie to maintain authenticated access to an account even after the password has been reset.

Recommendations Update Question2Answer to a version newer than 1.8.8. As a temporary mitigation, restrict access to the qa finish reset user() function or the forgot-password flow until a patch is applied.