Description
An insufficient session expiration vulnerability exists in the latest version of parisneo/lollms. The application fails to invalidate active sessions after a password reset, allowing an attacker to continue using an old session token. This issue arises due to the absence of logic to reject requests after a period of inactivity and the excessively long default session duration of 31 days. The vulnerability enables an attacker to maintain persistent access to a compromised account, even after the victim resets their password.
INFO
Published Date :
2026-04-08T02:20:50.573Z
Last Modified :
2026-04-08T15:58:36.451Z
Source :
@huntr_ai
AFFECTED PRODUCTS
The following products are affected by CVE-2026-1163 vulnerability.
| Vendors | Products |
|---|---|
| Parisneo |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2026-1163.
