The vulnerability lies in an improper invalidation of JSON Web Tokens (JWTs) when a user changes their password. Previously issued tokens remain valid until they naturally expire, allowing an attacker who has acquired or guessed a token to continue accessing protected API endpoints even after the account credentials have been updated. This results in unauthorized authenticated access that could expose sensitive project data or allow further exploitation.

The affected system is the Initiative project‑management platform from Morelitea. All releases before 0.32.4 are vulnerable; upgrading to 0.32.4 or later eliminates the flaw by invalidating existing tokens upon password change.

The CVSS score of 8.1 indicates a high severity; however, the EPSS score of less than 1% suggests a very low likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Attackers would need a valid JWT, which may be obtained through legitimate or malicious means, and then exploit the failure to refresh the token after a password change. The attack vector is inferred to be remote via the API, as the flaw pertains to token validity rather than code execution.