PT-2026-31070 · Parisneo · Lollms

Published 2026-01-08 · Updated 2026-04-08 · CVE-2026-1163

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:N/AC:H/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions parisneo/lollms (affected versions not specified)

Description The application does not invalidate active sessions after a password reset, allowing an attacker to continue using an old session token. This is due to a lack of logic to reject requests after inactivity and a long default session duration of 31 days. This enables an attacker to maintain persistent access to a compromised account, even after the victim resets their password.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

BDU:2026-05021

CVE-2026-1163

GHSA-8JG2-726G-XH43

Affected Products

Lollms

References · 12

• https://osv.dev/vulnerability/GHSA-8jg2-726g-xh43 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-1163 · Security Note
• https://bdu.fstec.ru/vul/2026-05021 · Security Note
• https://github.com/ParisNeo/lollms · Note
• https://twitter.com/CVEarity/status/2041814286998368290 · Twitter Post
• https://twitter.com/CVEnew/status/2041711816397771198 · Twitter Post
• https://t.me/cveNotify/158403 · Telegram Post
• https://huntr.com/bounties/abe2d1c4-c21c-4608-8a8e-274565246a8b · Note
• https://github.com/advisories/GHSA-8jg2-726g-xh43 · Note
• https://feedly.com/cve/CVE-2026-1163 · Note
• https://twitter.com/VulmonFeeds/status/2041816684764262598 · Twitter Post
• https://t.me/CVEtracker/50000 · Telegram Post