Mssql-Bypass - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/mssql-bypass/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 01 Sep 2026 17:07:20 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgMemos Refresh Token Revocation Failurehttps://feed.craftedsignal.io/briefs/2026-09-memos-token-revocation/Tue, 01 Sep 2026 17:07:20 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-memos-token-revocation/Memos versions 0.26.0 through 0.30.0 fail to invalidate refresh tokens after a password change, enabling persistent unauthorized access via the RefreshToken RPC.Memos versions 0.26.0 through 0.30.0 contain a critical session management vulnerability where the application fails to revoke existing refresh tokens upon a user password change. This security flaw means that if an attacker has already obtained a valid refresh token through previous compromise or session hijacking, they can continue to use that token to authenticate against the RefreshToken RPC endpoint. By repeatedly calling this RPC, the attacker can generate new access tokens and rotate the refresh token indefinitely, effectively bypassing the security intent of a password reset. This persistence mechanism allows an unauthorized actor to maintain account access long after the legitimate user believes they have secured their account by changing their credentials. Defenders should identify any anomalous RefreshToken RPC activity originating from sessions that predate recent password changes.

Impact

Successful exploitation allows an attacker to maintain persistent unauthorized access to affected Memos instances, bypassing account password changes. This impact spans all Memos deployments within the 0.26.0 to 0.30.0 range, affecting data integrity and confidentiality for all users within the environment. If compromised, attackers may gain continuous access to sensitive notes and stored information within the Memos platform without needing the current user password.

Recommendation

  1. Upgrade all Memos instances to a version later than 0.30.0 immediately to address the session management defect identified in CVE-2026-84203.
  2. Perform a global session revocation if suspicious activity is detected, as simple password resets will not invalidate existing sessions in affected versions.
  3. Audit webserver access logs for anomalous, high-frequency calls to the RefreshToken RPC endpoint that may indicate automated token rotation by an unauthorized actor.
]]>highadvisorysession-managementvulnerabilitymssql-bypass