Vulnerability · Published Aug 5, 2026 · Assigned by VulnCheck

CVE-2026-39923Flarum < 1.8.16 Password Reset Token Expiry Bypass via POST /reset

High 8.1

In plain English

A high-severity security flaw in Flarum Framework from Flarum. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.4%top 62.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Flarum before 1.8.16 contains a password reset token expiry bypass vulnerability that allows unauthenticated attackers to reuse expired password reset tokens by submitting them directly to the reset processing endpoint. The SavePasswordController::handle() method calls PasswordToken::findOrFail() without performing any expiry validation, allowing attackers to bypass the 24-hour token lifetime enforced only during form rendering and change any account's password to gain an authenticated session.

Affected products (as reported)

Vendor	Product	Versions
Flarum	Flarum Framework	0 – before 1.8.16

Weakness: CWE-324 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Release Notes release-notes
Pull Request issue-tracking
Patch Commit patch
https://www.vulncheck.com/advisories/flarum-password-reset-token-expiry-bypass-via-post-reset third-party-advisory