HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-39923 — Flarum before 1.8.16 contains a password reset token expiry bypass vulnerability...

·Source: NIST NVD

Updated:

Executive Summary

Flarum before 1.8.16 contains a password reset token expiry bypass vulnerability that allows unauthenticated attackers to reuse expired password reset tokens by submitting them directly to the reset processing endpoint. The SavePasswordController::handle() method calls PasswordToken::findOrFail() without performing any expiry validation, allowing attackers to bypass the 24-hour token lifetime enfo

Analysis

Flarum before 1.8.16 contains a password reset token expiry bypass vulnerability that allows unauthenticated attackers to reuse expired password reset tokens by submitting them directly to the reset processing endpoint. The SavePasswordController::handle() method calls PasswordToken::findOrFail() without performing any expiry validation, allowing attackers to bypass the 24-hour token lifetime enforced only during form rendering and change any account's password to gain an authenticated session. CVSS Score: 8.1. Published: 2026-08-05T16:16:55.980.

Indicators of Compromise (1)

CVE (1)
CVE-2026-39923
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Aug 5, 2026. Verified by: NIST.

Related Threats

HIGHVulnerabilityNEW

NVD HIGH: CVE-2026-8400 — IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Serv...

IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty Continuous delivery has a flaw in the ORB component in IBM SDK, Java Technology Edition, may allow a malicious IIOP server to induce loading and instantation of arbitrary classes.

CVE-2026-8400
NIST NVD
HIGHVulnerabilityNEW

NVD HIGH: CVE-2026-16442 — A flaw was found in the SAML broker component of Keycloak, which is used to mana...

A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication. The issue occurs because the IdP-initiated Single Sign-On endpoint fails to check if a provider is restricted to account linking only. This allows an attacker with control over a linked upstream identity to bypass login restrictions and gain full access to a local user ac

CVE-2026-16442
NIST NVD
HIGHVulnerabilityNEW

NVD HIGH: CVE-2026-15572 — A flaw was found in Keycloak's Dynamic Client Registration (DCR) security policy...

A flaw was found in Keycloak's Dynamic Client Registration (DCR) security policy management. The "Allowed Protocol Mapper Types" policy, which restricts which types of data mappers a client can use, fails to re-validate the mapper type during a client update if the mapper's configuration remains unchanged. An attacker with client registration privileges can exploit this by first registering an all

CVE-2026-15572
NIST NVD