Flarum before version 1.8.16 contains a flaw that allows an attacker who is already in possession of a valid session token or API bearer token to continue accessing the account after the account owner changes their password. The flaw stems from the TokensClearer::clearPasswordTokens() function, which removes rows from the password_tokens table but does not clear the access_tokens table or invalidate session cookies, leaving RememberAccessToken entries and other long‑lived tokens active. Because of this, a compromised session remains valid and an attacker can retain full account access, effectively bypassing the intended protection of a password reset.

The vulnerability affects all installations of the Flarum Framework running a version older than 1.8.16. Users who have not upgraded to the latest release are at risk while the application continues to store active session cookies and API bearer tokens after a password change.

Based on the description, the likely attack vector involves an attacker who has already obtained a valid session or API token, possibly through session hijacking, XSS, or compromised credentials. The CVSS score of 7.6 indicates high severity, but no EPSS score is available, so the estimated likelihood of exploitation is unknown. The vulnerability is not listed in CISA’s KEV catalog, suggesting it has not yet been widely exploited. Attackers require legitimate possession of a session token, which can be obtained via session hijacking, XSS, or compromised credentials, to exploit the flaw. Once in possession, they can maintain account access even after the legitimate user resets their password, rendering the password reset ineffective for revoking access.