CVE-2026-39924: Flarum Auth Bypass Vulnerability

CVE-2026-39924 Overview

CVE-2026-39924 is an improper session invalidation vulnerability [CWE-613] affecting Flarum forum software versions before 1.8.16. The flaw allows attackers holding a valid session token to retain full account access after a victim changes their password. The access_tokens table is never cleared during password change events, leaving all active session cookies and API bearer tokens intact. Long-lived RememberAccessToken entries also persist, and administrator-forced password resets through the user update endpoint fail to revoke attacker-held sessions.

Critical Impact
Attackers who compromise a session token maintain persistent account access even after the victim or an administrator changes the account password.

Affected Products

Flarum framework versions prior to 1.8.16
Flarum installations using the default TokensClearer implementation
Deployments relying on RememberAccessToken for long-lived sessions

Discovery Timeline

2026-08-05 - CVE-2026-39924 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-39924

Vulnerability Analysis

Flarum uses a TokensClearer service to handle token cleanup during account events such as password changes. The TokensClearer::clearPasswordTokens() function only removes rows from the password_tokens table, which contains password reset tokens. It does not touch the access_tokens table that stores active session cookies, API bearer tokens, and RememberAccessToken entries used for persistent logins.

When a user changes their password in response to suspected account compromise, the expected outcome is invalidation of all active sessions. In vulnerable versions, the attacker's stolen session token remains valid and continues to authenticate API requests. Administrator-initiated password resets through the user update endpoint exhibit the same behavior, preventing incident responders from forcibly logging out compromised accounts.

Root Cause

The root cause is incomplete session lifecycle handling in the PasswordChanged event listener. The TokensClearer class did not import or operate on the AccessToken model, so password change events triggered cleanup of only reset tokens. This design broke the security invariant that a password change revokes existing authenticated sessions.

Attack Vector

An attacker first obtains a valid session token through phishing, cross-site scripting, session fixation, or credential theft. The victim or administrator detects the intrusion and changes the account password. The attacker's original session cookie or bearer token continues to authenticate against the Flarum API, allowing continued account access, content modification, and privileged actions if the account holds administrative rights.

php

 namespace Flarum\User;
 
+use Flarum\Http\AccessToken;
 use Flarum\User\Event\EmailChanged;
 use Flarum\User\Event\PasswordChanged;
 use Illuminate\Contracts\Events\Dispatcher;

Source: GitHub Commit 5f08029 — the patch imports the AccessToken model into TokensClearer so that active sessions can be invalidated when PasswordChanged events fire.

Detection Methods for CVE-2026-39924

Indicators of Compromise

Access to authenticated Flarum API endpoints from a session cookie or bearer token whose associated account performed a password change after the session was issued
RememberAccessToken entries with last_activity_at timestamps that continue advancing after a password change event
Multiple concurrent active sessions for a single user account originating from geographically distinct IP addresses

Detection Strategies

Query the access_tokens table for entries with created_at timestamps earlier than the associated user's most recent password change
Correlate authentication logs against password change audit events to identify sessions that should have been invalidated
Alert on continued API activity from a session token following a PasswordChanged event for the same user

Monitoring Recommendations

Enable and centralize Flarum authentication and audit logs in a SIEM for correlation across account events
Monitor administrator-initiated password reset actions and validate that subsequent session activity ceases within a defined window
Track anomalies in RememberAccessToken usage patterns, including token reuse from new IP addresses after credential changes

How to Mitigate CVE-2026-39924

Immediate Actions Required

Upgrade Flarum to version 1.8.16 or later, which invalidates active sessions on password change
Manually purge the access_tokens table for any account suspected of compromise before applying the upgrade
Force logout of all users after upgrading to ensure no pre-existing sessions remain valid

Patch Information

The fix is delivered in Flarum release v1.8.16 via pull request #4546 and merged in commit 5f080293a029d0d273eb9678d597c74ea86a3bcc. The patch extends TokensClearer to remove AccessToken rows on PasswordChanged events, ensuring active sessions and remember-me tokens are revoked. Additional details are available in the VulnCheck advisory.

Workarounds

Directly delete rows from the access_tokens table for affected users following any password change until the patch is applied
Reduce the lifetime of RememberAccessToken entries to shrink the window of exposure
Restrict administrative access to trusted networks to limit initial session theft opportunities

bash

# Emergency workaround: purge active sessions for a compromised user
php flarum db:query "DELETE FROM access_tokens WHERE user_id = <USER_ID>;"

# Preferred remediation: upgrade to the patched release
composer require flarum/core:^1.8.16
php flarum migrate
php flarum cache:clear