SillyTavern uses a stateless cookie‑based session that stores all authentication data in a signed cookie. When a password is changed or a recovery step is completed, the application updates only the password hash in the database but leaves existing session cookies untouched. This allows an attacker who possesses a valid session cookie to continue using the account after the credential change, effectively enabling account takeover. The weakness is a classic session management error (CWE‑613).

SillyTavern versions prior to 1.18.0 are affected. Versions 1.18.0 and later include a fix that invalidates existing sessions when a password change or recovery occurs.

The CVSS score of 7.5 indicates a high impact vulnerability. Although EPSS data is not available, the lack of a server‑side session revocation mechanism makes exploitation straightforward for anyone who can capture or guess a session cookie, for example through phishing or compromised devices. The vulnerability is not listed in the CISA KEV catalog, but the high CVSS score and ability to reuse a stateless session make it a serious risk for deployed systems.