These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-39924 is an improper session invalidation vulnerability in Flarum before 1.8.16. Attackers with a valid session token can retain full account access even after a victim changes their password. The vulnerability exists because the access_tokens table is not cleared on password change events, leaving active session cookies and API bearer tokens intact.
CVE-2026-39923 is a critical vulnerability in Flarum, a forum software, that allows unauthenticated attackers to bypass the 24-hour password reset token lifetime. This is possible because the SavePasswordController::handle() method does not validate the token's expiry before processing it. As a result, attackers can reuse expired tokens to change any user's password, gaining an authenticated session.