CVE-2026-1163

MediumCVSS 4.1/10Last modified Jul 25, 2026

Description

An insufficient session expiration vulnerability exists in the latest version of parisneo/lollms. The application fails to invalidate active sessions after a password reset, allowing an attacker to continue using an old session token. This issue arises due to the absence of logic to reject requests after a period of inactivity and the excessively long default session duration of 31 days. The vulnerability enables an attacker to maintain persistent access to a compromised account, even after the victim resets their password.

Metrics

CVSS 3.0 4.1/10CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-613

Affected software

Vendor	Product	Versions
parisneo	parisneo/lollms	>= unspecified, <= latest

References

https://huntr.com/bounties/abe2d1c4-c21c-4608-8a8e-274565246a8b

Timeline

Published: Apr 8, 2026
Last modified: Jul 25, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-116308.8Use after free in File Input in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corruption via a CVE-2026-1163033.1Missing authorization in PostgreSQL type conversion allows a database user to invoke a cast function despite lacking EXECUTE privilege on th CVE-2026-1163048.8Use after free in PostgreSQL coordination of anonymous RECORD type identifiers among parallel workers allows a database user to execute arbi CVE-2026-1163068.8Type confusion in PostgreSQL composite-value field assignment allows an object creator to execute arbitrary code as the operating system use CVE-2026-1163078.8Use after free in PostgreSQL plperl allows an object creator to execute arbitrary code as the operating system user running the database, vi CVE-2026-1163084.3Buffer over-read in PostgreSQL dict_int allows a database user to disclose portions of server memory, via a zero-length token. Versions bef CVE-2026-1163098.8Type confusion in PostgreSQL plperl may allow an object creator to execute arbitrary code, via blessing a non-hash reference into PostgreSQL CVE-2026-116318.3Use after free in Aura in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer proces CVE-2026-1163104.3Use after free in PostgreSQL COPY FROM error reporting allows a database user to disclose portions of server memory, via a longer input row CVE-2026-1163115.4Missing authorization in PostgreSQL DROP OWNED allows a role to remove itself from restrictive row level security policies, thereby reading CVE-2026-1163125.4Inconsistent transition-capture state in PostgreSQL MERGE allows a table data modifier to make an AFTER trigger process the wrong new row, v CVE-2026-1163137.2Untrusted search path in PostgreSQL vacuumdb allows a database owner to execute arbitrary SQL as the database user running vacuumdb, via sha