Vulnerability · Published Apr 8, 2026 · Assigned by @huntr_ai
CVE-2026-1163Insufficient Session Expiration in parisneo/lollms
Medium 4.1
In plain English
A medium-severity security flaw in parisneo/lollms from parisneo. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).
Official description
An insufficient session expiration vulnerability exists in the latest version of parisneo/lollms. The application fails to invalidate active sessions after a password reset, allowing an attacker to continue using an old session token. This issue arises due to the absence of logic to reject requests after a period of inactivity and the excessively long default session duration of 31 days. The vulnerability enables an attacker to maintain persistent access to a compromised account, even after the victim resets their password.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | lollms | no fix listed | GHSA-8jg2-726g-xh43 |
| PyPI | lollms | no fix listed | PYSEC-2026-2612 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| parisneo | parisneo/lollms | unspecified – through latest |
Weakness: CWE-613 · Vector: CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L