CVE-2026-1163

CVE-2026-1163 describes an insufficient session expiration in the latest version of parisneo/lollms, where active sessions are not invalidated after a password reset due to missing logic to reject idle requests and a default 31-day session duration. This enables a compromised account to retain ac...