CVE-2026-39924

Name of the Vulnerable Software and Affected Versions Flarum versions prior to 1.8.16

Description Improper session invalidation allows attackers with a valid session token to maintain full account access even after a password change. This occurs because the access tokens table is not cleared during password change events. Specifically, the TokensClearer::clearPasswordTokens() function only removes entries from the password tokens table, leaving active session cookies, API bearer tokens, and long-lived RememberAccessToken entries intact. Additionally, administrator-forced password resets performed via the user update endpoint fail to revoke these active sessions.

Recommendations Update to version 1.8.16 or later.