PT-2026-68185

Name of the Vulnerable Software and Affected Versions Flarum versions prior to 1.8.16 Description Improper session invalidation allows attackers with a valid session token to maintain full account access even after a password change. This occurs because the access tokens table is not cleared duri...

CVE-2026-39924: Insufficient Session Expiration

Flarum before 1.8.16 contains an improper session invalidation vulnerability that allows attackers who hold a valid session token to retain full account access after a victim changes their password, because the accesstokens table is never cleared on password change events. The...