CVE-2026-44648

SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to 1.18.0, SillyTavern relies on cookie-session for authentication, storing all session data user handle,...

CVE-2026-44648 SillyTavern: Existing sessions are not invalidated after password change, allowing session reuse and account takeover

SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to 1.18.0, SillyTavern relies on cookie-session for authentication, storing all session data user handle,...

CVE-2026-44648

creationtimestamp| type| source ---|---|--- 2026-05-08 07:04:33+00:00| seen| Telegram/J5ZhgOkVkOGh10nZtfdrFvjUVC9Q3mZbF4dClPdmsBvh90 2026-05-08 09:00:04+00:00| seen| Telegram/9hUmSN7ug2EVEMoe54drMVTAFxceMDTI0JA9Kzj6srBhh7g 2026-05-11 20:48:45+00:00| published-proof-of-concept|...