An insufficient session expiration vulnerability causes the application to keep an active session token valid even after a user resets their password. The lack of a mechanism to reject requests after inactivity and the default 31-day session lifetime allow an attacker who already holds a session cookie to maintain access, leading to persistent unauthorized control of the compromised account.

The Parisneo lollms application is affected, specifically the latest publicly released version(s). No detailed version range is disclosed, so deployments using the default 31-day session configuration should be reviewed for exposure.

The CVSS base score of 4.1 indicates moderate severity, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is possession of an active session cookie prior to the password reset; an attacker can trigger a password change and then continue using the old token because the session is not invalidated. EPSS data is unavailable, but the moderate score suggests that exploitation could occur if the conditions are met.