The vulnerability lies in the password reset routine of Coop, which updates the user’s password without invalidating existing database-backed sessions. An attacker who has already compromised a user’s credentials can keep the session alive after the legitimate account holder changes the password. Because the session’s maximum age is 30 days, the attacker can maintain access for that duration, potentially allowing continued unauthorized actions. This weakness corresponds to CWE‑613, indicating a failure to properly invalidate user sessions.

Roostorg’s Coop tool, versions prior to 1.0.2, is affected. The issue remains until the updated release 1.0.2 or later is installed.

The CVSS score of 2.3 indicates a low-severity weakness, and the EPSS score is not available, so the exploitation likelihood cannot be quantified. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a compromised credential scenario: an attacker who has obtained a valid password and established a session can continue to use it after the legitimate user resets the password. The impact is limited to the single compromised account and is mitigated by the session’s 30‑day expiration, but the attacker retains control during that period.