PT-2026-31070 · Parisneo · Parisneo/Lollms

Published 2026-04-08 · Updated 2026-04-08 · CVE-2026-1163

Mitre

CVSS v3.1

4.1

Medium

AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L

An insufficient session expiration vulnerability exists in the latest version of parisneo/lollms. The application fails to invalidate active sessions after a password reset, allowing an attacker to continue using an old session token. This issue arises due to the absence of logic to reject requests after a period of inactivity and the excessively long default session duration of 31 days. The vulnerability enables an attacker to maintain persistent access to a compromised account, even after the victim resets their password.

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2026-1163

Affected Products

Parisneo/Lollms

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-1163 · Security Note
• https://huntr.com/bounties/abe2d1c4-c21c-4608-8a8e-274565246a8b · Note