CVE-2026-84203: Memos 0.26.0 through 0.30.0 Insufficient Session Expiration on Password Change
Memos versions 0.26.0 through 0.30.0 fail to revoke refresh tokens when a user changes their password, allowing attackers to maintain account access. An attacker with a stolen refresh token can call the RefreshToken RPC to obtain new access tokens and rotate the refresh token indefinitely, bypassing the password change security measure.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
memosto a version that resolves this vulnerability.Fixed in 0.30.0
Event History
Frequently Asked Questions
Who is exposed to continued account access after a password change?
Users of Memos versions 0.26.0 through 0.30.0 are affected if an attacker has already obtained one of their refresh tokens. The attacker can retain access even after the user changes their password.
What does an attacker need to exploit this issue?
The attacker needs a stolen valid refresh token for the target account and the ability to call the RefreshToken RPC. No user interaction is required after the token has been obtained.
How can access persist despite a password reset?
Changing the password does not revoke existing refresh tokens in the affected versions. A stolen refresh token can be exchanged for new access tokens and rotated refresh tokens indefinitely.