External risk intelligence

Flarum Password Reset Token Expiry Bypass Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-39923

Flarum is a web application platform. Password reset functionality is a standard, public-facing feature of web applications designed to be reachable by users over the internet, making this endpoint an accessible part of the application's external attack surface.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability exists in Flarum software that allows an attacker to bypass password reset expiration. This could enable unauthorized access to user accounts by reusing old reset tokens. The main concern is confirming if this specific software is in use and if it is exposed externally.

Expired password resets can be reused.
Bypasses security controls for account recovery.
Confirm Flarum use and external exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by reusing an expired password reset token. This is possible because the system fails to validate the token's expiry when processing a password reset request, allowing an attacker to submit a token directly to the reset endpoint. Successfully bypassing the expiry check enables an attacker to change any account's password and gain authenticated access.

No authentication required to access.
Submit expired reset token to endpoint.
Gain unauthorized account access.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to reset the password for any user account. This is possible by submitting an expired password reset token directly to the reset processing endpoint, bypassing the intended expiry validation. When successful, an attacker could gain authenticated access to any account.

User account credentials and access.
Expired tokens submitted to reset endpoint.
Unauthorized authenticated session takeover.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Flarum's password reset mechanism requires a coordinated effort between application owners and infrastructure or platform teams. The immediate priority is to identify all Flarum instances, determine their exposure and criticality, and then engage the accountable teams to plan and execute remediation, potentially involving vendor coordination.

Application owners must prioritize this.
Verify Flarum instance reachability and criticality.
Plan and coordinate remediation actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Flarum and how is it used?

Flarum is a popular open-source forum software platform designed for building online communities and discussion boards. It is widely used by organizations and individuals to host interactive websites where users can create accounts, share content, and manage profiles. Because it provides community-focused tools, the software is typically deployed as a web application that remains accessible to users over the internet for account registration and authentication.

What does CVE-2026-39923 mean for my account security?

This vulnerability, classified as a token misuse issue under CWE-324, occurs because the system fails to check if a password reset token has expired when a user attempts to save a new password. Normally, a reset link should only be valid for 24 hours. Because this verification is missing at the processing stage, an attacker can take an old, expired token and use it to change the password of any account, effectively taking control of that account.

How does an attacker trigger this password reset flaw?

An attacker triggers this by interacting directly with the password reset processing endpoint rather than using the standard web interface. By submitting an expired reset token, they bypass the system's security checks. This flaw is specifically about the failure to validate token age on the server side; simply rendering the reset form in a browser does not trigger the bug, as the underlying validation logic for token expiry is what fails during the submission request.

Do I need to worry if my Flarum site is public?

Yes. According to Halo Surface Signal, this vulnerability is a high priority for public-facing Flarum instances. Because the password reset endpoint is designed to be reachable over the internet for legitimate users, it forms part of the application's external attack surface. If your site is accessible from the internet, an attacker can target these endpoints without needing prior access or authentication to your network or account.

When should I update my Flarum software?

You should prioritize updating as soon as possible. The first step is to inventory your environment to locate all running instances of Flarum. Once you have identified them, evaluate their exposure and plan for an update to version 1.8.16 or later. Coordinate with your application and infrastructure teams to ensure that these instances are patched, as this will restore the necessary validation checks to your password reset process.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.