Flarum versions earlier than 1.8.16 contain a flaw that allows an attacker to reuse an expired password reset token by submitting it directly to the reset processing endpoint. The token validity, normally enforced only during form rendering, is not checked when processing the reset, enabling the attacker to change any user’s password. The result is that an unauthenticated user can obtain an authenticated session for any account, which is a critical compromise of confidentiality and integrity. This weakness falls under CWE‑324, a time‑based functionality failure.

All installations of the Flarum Framework running a version older than 1.8.16 are affected. The vulnerability impacts the password reset feature across the entire framework and is not confined to a specific module.

The CVSS score of 9.2 marks the issue as critical. The EPSS score is not available, so the likelihood of exploitation cannot be quantified, but the flaw can be easily leveraged by any attacker who can construct a POST request to /reset with a valid expired token. The vulnerability is not listed in CISA’s KEV catalog, suggesting no public exploit has been confirmed yet, yet the absence of an expiry check makes exploitation straightforward once an expired token is known or guessed.