CVE-2019-11514

User/Command/ConfirmEmailHandler.php in Flarum before 0.1.0-beta.8 mishandles invalidation of user email tokens...

CVE-2019-11514

Summary (CVE-2019-11514): In Flarum core, the file User/Command/ConfirmEmailHandler.php mishandles invalidation of user email tokens prior to 0.1.0-beta.8. This creates insecure session management where email tokens can be reused, potentially enabling a remote attacker to gain access to a user ac...