CVE-2026-64829 Overview
CVE-2026-64829 is a session invalidation vulnerability in Question2Answer through version 1.8.8. The forgot-password reset flow fails to clear the sessioncode field used to validate persistent qa_session remember-me cookies. An attacker holding a previously issued remember-me cookie retains authenticated access after the legitimate user completes a password reset. The flaw resides in qa_finish_reset_user() within qa-include/app/users-edit.php, which omits the sessioncode clearing step performed by the normal password-change flow in qa-include/pages/account.php. This weakness maps to [CWE-613] Insufficient Session Expiration.
Critical Impact
Attackers with a stolen remember-me cookie maintain persistent authenticated access to victim accounts even after the victim resets their password to recover from a suspected compromise.
Affected Products
- Question2Answer through 1.8.8
- Deployments using persistent qa_session remember-me cookies
- Installations exposing the forgot-password reset flow
Discovery Timeline
- 2026-07-22 - CVE-2026-64829 published to NVD
- 2026-07-22 - Last updated in NVD database
Technical Details for CVE-2026-64829
Vulnerability Analysis
Question2Answer issues persistent authentication cookies (qa_session) tied to a per-user sessioncode value stored in the database. Validating a remember-me cookie requires the cookie's session code to match the current stored sessioncode. Rotating that field is the intended mechanism for invalidating all outstanding persistent sessions.
The standard password-change routine in qa-include/pages/account.php explicitly overwrites sessioncode when a user updates their password. This forces every previously issued qa_session cookie to fail validation on subsequent requests.
The forgot-password reset routine qa_finish_reset_user() in qa-include/app/users-edit.php updates the password hash but omits the sessioncode rotation. Consequently, any remember-me cookie issued prior to the reset continues to authenticate the account afterward.
Root Cause
The root cause is inconsistent session lifecycle handling between two code paths that both change a user's password. The reset handler treats password mutation as a credential update without treating it as a session-invalidation event. Any actor who obtained a valid qa_session cookie through cookie theft, cross-site scripting, log exposure, or shared-device reuse remains authenticated through the reset.
Attack Vector
An attacker first obtains a valid remember-me cookie for a target account. The victim, suspecting compromise or forgetting their password, initiates the forgot-password reset flow and sets a new password. The attacker replays the original qa_session cookie against the site and remains logged in as the victim. The remediation, submitted in the upstream GitHub Pull Request 1017, adds sessioncode clearing to qa_finish_reset_user() to align both flows. Additional analysis is available in the VulnCheck Security Advisory.
Detection Methods for CVE-2026-64829
Indicators of Compromise
- Successful authentication events using qa_session cookies issued before a documented password reset timestamp.
- Concurrent active sessions for a single account originating from disparate IP addresses or user agents after a reset.
- Account activity from historically unseen geolocations immediately following a forgot-password completion event.
Detection Strategies
- Correlate users table passsalt/password hash change timestamps against subsequent qa_session cookie usage in web server access logs.
- Alert on sessions where the cookie's issuance date precedes the account's last password reset event.
- Instrument the reset handler with logging that captures the current sessioncode value before and after reset completion.
Monitoring Recommendations
- Track forgot-password reset events and cross-reference with authenticated request patterns for the following 24 to 72 hours.
- Monitor for anomalous authenticated actions such as profile email changes, privilege changes, or content deletion soon after resets.
- Ingest Question2Answer application logs and web server logs into a centralized analytics platform for cookie-lifecycle correlation.
How to Mitigate CVE-2026-64829
Immediate Actions Required
- Apply the upstream patch from GitHub Pull Request 1017 to add sessioncode invalidation to qa_finish_reset_user().
- Force a global rotation of sessioncode values in the users table to invalidate all outstanding persistent cookies.
- Require re-authentication for all users and audit recently reset accounts for unauthorized activity.
Patch Information
The upstream fix modifies qa_finish_reset_user() in qa-include/app/users-edit.php to clear the sessioncode field as part of the password reset transaction. Administrators running Question2Answer 1.8.8 or earlier should merge the patch from the GitHub Pull Request 1017 or upgrade to a release incorporating the fix once available.
Workarounds
- Disable remember-me functionality by removing or shortening the persistent qa_session cookie lifetime in site configuration.
- Manually clear the sessioncode column for any user completing a password reset until the patch is deployed.
- Restrict access to the forgot-password endpoint via a web application firewall rule while preparing the update.
# Force-invalidate all persistent qa_session cookies by rotating sessioncode
mysql -u <db_user> -p <q2a_database> -e "UPDATE qa_users SET sessioncode = SUBSTRING(MD5(RAND()) FROM 1 FOR 8);"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
