An insufficient session expiration vulnerability exists in the latest version of parisneo/lollms. The application fails to invalidate active sessions after a password reset, allowing an attacker to continue using an old session token. This issue arises due to the absence of logic to reject requests after a period of inactivity and the excessively long default session duration of 31 days. The vulnerability enables an attacker to maintain persistent access to a compromised account, even after the victim resets their password.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Wed, 08 Apr 2026 02:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | An insufficient session expiration vulnerability exists in the latest version of parisneo/lollms. The application fails to invalidate active sessions after a password reset, allowing an attacker to continue using an old session token. This issue arises due to the absence of logic to reject requests after a period of inactivity and the excessively long default session duration of 31 days. The vulnerability enables an attacker to maintain persistent access to a compromised account, even after the victim resets their password. | |
| Title | Insufficient Session Expiration in parisneo/lollms | |
| Weaknesses | CWE-613 | |
| References |
| |
| Metrics |
cvssV3_0
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: @huntr_ai
Published:
Updated: 2026-04-08T02:20:50.573Z
Reserved: 2026-01-18T21:30:57.148Z
Link: CVE-2026-1163
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-04-08T03:16:07.500
Modified: 2026-04-08T03:16:07.500
Link: CVE-2026-1163
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses