CVE-2026-39923

Name of the Vulnerable Software and Affected Versions Flarum versions prior to 1.8.16

Description Unauthenticated attackers can reuse expired password reset tokens by submitting them directly to the '/reset' endpoint. This occurs because the SavePasswordController::handle() method utilizes PasswordToken::findOrFail() without validating the token's expiration. Consequently, the 24-hour token lifetime, which is only enforced during form rendering, is bypassed, allowing an attacker to change any account password and obtain an authenticated session.

Recommendations Update Flarum to version 1.8.16 or later.