CVE-2026-1163
MediumCVSS 4.1Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
The latest version of parisneo/lollms contains an insufficient session expiration vulnerability. The application fails to invalidate active sessions after a password reset, allowing an attacker to continue using an old session token. This is due to the absence of logic to reject requests after inactivity and the excessively long default session duration of 31 days. Attackers can maintain persistent access to a compromised account even after the victim resets their password.
Risk Assessment
Attackers can retain access to the victim's account even after a password change, potentially leading to prolonged data confidentiality breaches and further attacks.
Recommendation
Implement session invalidation after password changes and reduce the default session duration.
Original NVD description (English source)
An insufficient session expiration vulnerability exists in the latest version of parisneo/lollms. The application fails to invalidate active sessions after a password reset, allowing an attacker to continue using an old session token. This issue arises due to the absence of logic to reject requests after a period of inactivity and the excessively long default session duration of 31 days. The vulnerability enables an attacker to maintain persistent access to a compromised account, even after the victim resets their password.