https://feed.craftedsignal.io/tags/cve-2026-39923/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 05 Aug 2026 17:20:30 +0000https://feed.craftedsignal.io/briefs/2026-08-flarum-token-bypass/Wed, 05 Aug 2026 17:20:30 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-flarum-token-bypass/Flarum versions prior to 1.8.16 are vulnerable to an unauthenticated password reset token expiry bypass, allowing attackers to reuse expired tokens to gain unauthorized account access.<p>Flarum versions prior to 1.8.16 contain a security flaw in the password reset mechanism. The vulnerability exists within the SavePasswordController::handle() method, which fails to perform server-side validation of token expiration during the processing phase of a password reset.</p> <p>Although the platform enforces a 24-hour lifetime for password reset tokens during the initial form rendering process, this check is not re-validated when the submission is processed. Consequently, an unauthenticated attacker can capture or brute-force expired password reset tokens and submit them directly to the reset processing endpoint. Successful exploitation allows the attacker to reset any user account password, resulting in full account takeover and unauthorized authenticated access to the application. This vulnerability presents a high risk for organizations using Flarum for forum management or community hosting.</p> highadvisoryweb-vulnerabilityaccount-takeovercve-2026-39923