A critical vulnerability in the Flarum Framework allows attackers to bypass password reset token expiration, potentially enabling unauthorized account takeovers.

The software suffers from the use of a key past its expiration date (CWE-324). This flaw allows an attacker to reuse or extend password reset tokens that should have been invalidated, effectively bypassing the intended security window for account recovery.

Successful exploitation of this flaw could lead to full account takeover, granting attackers unauthorized access to user accounts and their associated privileges. With a CVSS score of 8.1, the potential for widespread account compromise presents a major risk to user data integrity and overall platform security.

Immediate Action: Upgrade Flarum Framework to version 1.8.16 or higher immediately to resolve the token expiration defect.

Proactive Monitoring: Monitor authentication logs for unusual patterns in password reset requests or multiple successful resets for the same account occurring outside of expected timeframes.

Compensating Controls: While no direct WAF rule can fully mitigate this logic flaw, enforcing multi-factor authentication on all user accounts will prevent an attacker from gaining full control even if they bypass the password reset mechanism.

Public Exploit Available: No

Given the high impact of potential account takeovers, administrators must treat this update with high priority. Patching to version 1.8.16 is the only reliable way to ensure that password reset tokens are correctly invalidated after their intended expiration.