CVE-2026-84203

Name of the Vulnerable Software and Affected Versions Memos versions 0.26.0 through 0.30.0

Description The software fails to revoke refresh tokens when a user changes their password, which allows unauthorized parties to maintain account access. An attacker possessing a stolen refresh token can call the RefreshToken RPC to obtain new access tokens and rotate the refresh token indefinitely, bypassing the security measure intended to terminate sessions upon a password change.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.