VulnerabilityDeferred

CVE-2026-1163

An insufficient session expiration vulnerability exists in the latest version of parisneo/lollms.

MEDIUM 4.1EPSS 0.21%

Does this matter?

Lower severity and a low EPSS score (0.21%). Track it; it rarely justifies an emergency change on its own.

Description

An insufficient session expiration vulnerability exists in the latest version of parisneo/lollms. The application fails to invalidate active sessions after a password reset, allowing an attacker to continue using an old session token. This issue arises due to the absence of logic to reject requests after a period of inactivity and the excessively long default session duration of 31 days. The vulnerability enables an attacker to maintain persistent access to a compromised account, even after the victim resets their password.

CVSS 3.0: 4.1 MEDIUMCVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L
EPSS: 0.21% probability · 11th percentile
CISA KEV: Not listed
Weakness: CWE-613
Source: security@huntr.dev

References

https://huntr.com/bounties/abe2d1c4-c21c-4608-8a8e-274565246a8b

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.