{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/vendors/question2answer/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.4,"id":"CVE-2026-64829"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Question2Answer \u003c= 1.8.8"],"_cs_severities":["medium"],"_cs_tags":["question2answer","vulnerability","session-management","web-application","cve"],"_cs_type":"advisory","_cs_vendors":["Question2Answer"],"content_html":"\u003cp\u003eCVE-2026-64829 details a critical session invalidation vulnerability present in Question2Answer versions up to and including 1.8.8. This flaw arises because the application's \u003ccode\u003eforgot-password\u003c/code\u003e reset flow, handled by \u003ccode\u003eqa_finish_reset_user()\u003c/code\u003e in \u003ccode\u003eqa-include/app/users-edit.php\u003c/code\u003e, fails to clear the \u003ccode\u003esessioncode\u003c/code\u003e field within existing \u003ccode\u003eqa_session\u003c/code\u003e cookies. Unlike the standard password-change mechanism in \u003ccode\u003eqa-include/pages/account.php\u003c/code\u003e, which properly invalidates persistent sessions, the reset flow neglects this crucial step. Consequently, any attacker who has previously acquired a legitimate \u003ccode\u003eremember-me\u003c/code\u003e cookie for a target account can continue to maintain authenticated access to that account even after the rightful owner successfully performs a password reset. This bypass of intended security measures allows for persistent unauthorized access, posing a significant risk to user data and application integrity.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003e\u003cstrong\u003eInitial Access\u003c/strong\u003e: An attacker obtains a legitimate \u003ccode\u003eremember-me\u003c/code\u003e cookie associated with a target user's Question2Answer account through unspecified means (e.g., prior credential compromise, client-side vulnerability, or direct access to the victim's browser).\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eAuthenticated Session Establishment\u003c/strong\u003e: The attacker utilizes the acquired \u003ccode\u003eremember-me\u003c/code\u003e cookie to successfully authenticate and establish an active session with the vulnerable Question2Answer application.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eLegitimate User Initiates Reset\u003c/strong\u003e: The legitimate account owner initiates a password reset for their account through the \u003ccode\u003eforgot-password\u003c/code\u003e functionality provided by Question2Answer.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003ePassword Reset Completion\u003c/strong\u003e: The legitimate user completes the password reset process, thereby changing their account password.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eFlawed Session Invalidation\u003c/strong\u003e: During the password reset, the \u003ccode\u003eqa_finish_reset_user()\u003c/code\u003e function in \u003ccode\u003eqa-include/app/users-edit.php\u003c/code\u003e updates the user's password but fails to invalidate or clear the \u003ccode\u003esessioncode\u003c/code\u003e associated with the previously issued \u003ccode\u003eqa_session\u003c/code\u003e (remember-me) cookie.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003ePersistent Cookie Usage\u003c/strong\u003e: The attacker, still possessing the original \u003ccode\u003eremember-me\u003c/code\u003e cookie with its uncleared \u003ccode\u003esessioncode\u003c/code\u003e, continues to send requests to the Question2Answer application using this cookie.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eUnauthorized Access Maintenance\u003c/strong\u003e: The Question2Answer application validates the persistent \u003ccode\u003eremember-me\u003c/code\u003e cookie as still valid, granting the attacker continued authenticated access to the user's account, effectively bypassing the intended security measure of a password change.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eImpact\u003c/strong\u003e: The attacker maintains unauthorized persistent access to the user's account, enabling them to perform actions, view private information, or manipulate content as the legitimate user.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-64829 results in a persistent breach of account confidentiality and integrity. An attacker can maintain full authenticated access to a user's Question2Answer account indefinitely, even after the legitimate user has changed their password. This allows the attacker to perform any action the user could, such as accessing sensitive user profiles, posting malicious content, defacing sections of the platform, sending messages under the user's identity, or extracting private data. While specific victim counts are not available, all Question2Answer installations running versions through 1.8.8 are susceptible, potentially exposing personal information and compromising the platform's reputation and trust for its entire user base.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eApply the patch for CVE-2026-64829 from Question2Answer when it becomes available to remediate the session invalidation vulnerability.\u003c/li\u003e\n\u003cli\u003eMonitor web server access logs for \u003ccode\u003eqa-include/app/users-edit.php\u003c/code\u003e for unusual activity, particularly focusing on requests immediately following a user-initiated password reset.\u003c/li\u003e\n\u003cli\u003eImplement application-level logging to correlate password reset events with subsequent authenticated sessions, looking for \u003ccode\u003eqa_session\u003c/code\u003e cookies that remain active after a reset.\u003c/li\u003e\n\u003cli\u003eConsider implementing a feature to allow users or administrators to forcefully invalidate all active sessions for an account, especially after a suspected compromise or password reset.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-22T20:19:43Z","date_published":"2026-07-22T20:19:43Z","id":"https://feed.craftedsignal.io/briefs/2026-07-question2answer-session-invalidation/","summary":"Attackers can exploit CVE-2026-64829, a session invalidation vulnerability in Question2Answer through version 1.8.8, where the forgot-password reset flow fails to clear the sessioncode field, allowing an attacker with a previously obtained remember-me cookie to retain authenticated access even after the account's password has been reset.","title":"Question2Answer Session Invalidation Vulnerability","url":"https://feed.craftedsignal.io/briefs/2026-07-question2answer-session-invalidation/"}],"language":"en","title":"CraftedSignal Threat Feed - Question2Answer","version":"https://jsonfeed.org/version/1.1"}