YesWiki versions prior to 4.6.7 generate password reset tokens that lack an expiry timestamp, creating an insufficient session expiration weakness (CWE‑613). Attackers who obtain an unused password‑reset URL from email archives, server logs, backups, or browser history can replay the link, set a new password, and gain ownership of the affected account. This flaw enables unauthorized account takeover without requiring any additional authentication or administrative privileges.

This vulnerability applies to the YesWiki content management system, specifically all releases before version 4.6.7. Users running YesWiki 4.6.6 or earlier are exposed unless they have applied a custom patch that adds token expiration.

The CVSS base score of 6.3 indicates a medium severity vulnerability, and the EPSS score is not available, making exploitation probability difficult to quantify. This vulnerability is a CWE‑613 insufficient session expiration. The vulnerability is not listed in CISA's KEV catalog. Attackers can exploit the flaw through the LostPasswordAction endpoint by submitting a captured reset URL; the exploit path requires only that the attacker has the URL, which may be delivered via phishing, email interception, or log exposure. Once the URL is used, the victim’s session is hijacked and the attacker can continue to use the account until it is manually reset.