CVE-2026-39923: Flarum < 1.8.16 Password Reset Token Expiry Bypass via POST /reset
Flarum before 1.8.16 contains a password reset token expiry bypass vulnerability that allows unauthenticated attackers to reuse expired password reset tokens by submitting them directly to the reset processing endpoint. The SavePasswordController::handle() method calls PasswordToken::findOrFail() without performing any expiry validation, allowing attackers to bypass the 24-hour token lifetime enforced only during form rendering and change any account's password to gain an authenticated session.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-39923?
CVE-2026-39923 has a severity rating of 8.1, indicating a high level of risk.
How do I fix CVE-2026-39923?
To fix CVE-2026-39923, upgrade Flarum to version 1.8.16 or later.
What type of attack is possible with CVE-2026-39923?
CVE-2026-39923 allows unauthenticated attackers to bypass expiration checks on password reset tokens.
What systems are affected by CVE-2026-39923?
CVE-2026-39923 affects Flarum versions prior to 1.8.16.
When was CVE-2026-39923 published?
CVE-2026-39923 was published on August 5, 2026.