PT-2026-40544 · Sillytavern+1 · Sillytavern

Zzzm0919 · Published 2026-05-12 · Updated 2026-05-29 · CVE-2026-44648

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SillyTavern versions prior to 1.18.0

Description SillyTavern uses cookie-session for authentication, where session data such as user handles and permissions are stored in a signed cookie. The endpoints "POST /api/users/change-password" and "POST /api/users/recover-step2" update the password hash in the database but fail to expire active sessions. Since the session is stateless and stored entirely within the client cookie, the server lacks a mechanism to revoke a token after it has been issued. This allows an attacker with a stolen session cookie to maintain access to an account even after the legitimate user has reset their password.

Recommendations Update to version 1.18.0.

Exploit

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2026-44648

GHSA-WMM3-H9QJ-P5V6

Affected Products

Sillytavern

References · 7

• 🔥 https://github.com/SillyTavern/SillyTavern/security/advisories/GHSA-wmm3-h9qj-p5v6 · Exploit
• https://osv.dev/vulnerability/GHSA-wmm3-h9qj-p5v6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44648 · Security Note
• https://github.com/SillyTavern/SillyTavern · Note
• https://github.com/SillyTavern/SillyTavern/releases/tag/1.18.0 · Note
• https://twitter.com/CVEnew/status/2060470701975326934 · Twitter Post
• https://twitter.com/infoflowcloud/status/2060471542094426237 · Twitter Post