External risk intelligence

Question2Answer Session Invalidation via Password Reset.

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-64829

Question2Answer is a platform typically deployed as a public-facing Q&A web application. Because the vulnerability involves the session management and authentication flow of a web-based application, it is commonly accessible via the public internet as part of the standard deployment pattern for such web services.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This issue affects Question2Answer software, a platform for Q&A websites, and could allow unauthorized access to user accounts through a flaw in the password reset process. While the full impact requires further investigation into specific deployments, the core concern is the potential for session fixation.

Session flaw allows unauthorized access.
Affects password reset, impacting account security.
Confirm relevance and exposure of the software.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by first obtaining a valid "remember-me" cookie. They would then trigger the password reset process, which, due to insufficient session handling, allows the attacker to bypass full session invalidation. This can lead to the attacker maintaining authenticated access even after the legitimate user resets their password.

Attacker must possess a valid cookie.
Exploited during password reset flow.
Risk of persistent authenticated access.

Live Threat

Current exploitation, exposure, and threat context

An attacker who has obtained a previously issued "remember-me" cookie could maintain authenticated access to a user's account even after the user performs a password reset. This is because the forgot-password reset flow fails to properly invalidate active sessions by clearing the session code, allowing the old cookie to continue authenticating the user.

Persistent authenticated access.
Session cookie reuse.
Account takeover.

Operational Fix

Recommended remediation, mitigation, and detection steps

Question2Answer is likely deployed as a public-facing web application, making application owners, infrastructure teams, and potentially vendor-management teams responsible for addressing this vulnerability. The first practical step is to identify all instances of Question2Answer, confirm their accessibility and business criticality, and then determine the accountable owner to plan remediation.

Application owners and infrastructure teams.
Verify affected instances and exposure.
Plan risk-based remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Question2Answer software?

Question2Answer is an open-source platform designed for building community-driven question-and-answer websites. It helps users host forums where community members can post questions, provide answers, and vote on content. Because it is a web-based application, it typically runs on servers to provide public access for interaction and knowledge sharing.

What does CWE-613 mean for CVE-2026-64829?

CWE-613 identifies a weakness related to insufficient session expiration. In this specific CVE, it means the application fails to properly end a user's session after a significant security event—in this case, a password reset. Because the system does not invalidate old authentication tokens, a session that should be dead remains active, potentially giving unauthorized parties continued access to an account.

How can this vulnerability be triggered?

An attacker must possess a previously issued 'remember-me' cookie from a target user account to initiate the attack. If the user then uses the platform's forgot-password reset flow, the vulnerability triggers because the system fails to clear the associated session code. Simply changing a password through the normal account settings page does not trigger this flaw, as that method correctly clears the session.

Why should I care about this as a platform owner?

According to Halo Surface Signal, Question2Answer is frequently deployed as a public-facing web application. This exposure means that the authentication flow is often reachable over the internet, increasing the likelihood that an attacker could attempt to exploit session management flaws. If your instance is internet-facing, it is more susceptible to these types of remote access issues.

How do I respond to this security advisory?

Your first step is to locate all active Question2Answer installations within your environment to understand your footprint. Once identified, work with the designated application owners to assess the business risk. Since this issue involves account security and session management, prioritize identifying instances where user accounts handle sensitive information and prepare to apply security updates as they become available.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.