Live › vulnerability › CVE-2026-63400
Coop, an open source review and moderation tool from ROOST, does not end existing database-backed sessions when a password is reset via resetPasswordForToken. An attacker who already holds a session keeps access after the user changes the password, until that session expires at its 30-day maximum age.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 23:26 UTC. All times on this page are UTC.
Teams that run Coop before version 1.0.2 and use its password reset flow, where an attacker may already hold a valid session. The sources do not say whether self-hosted and managed deployments differ. Teams on 1.0.2 or later are not affected.
No product ranges from the sources yet.
1.0.2 are affected.1.0.2 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, resetPasswordForToken updates the password row without invalidating database-backed sessions. An attacker who has acquired a password and established a session retains access even after the legitimate user resets the password, leaving the compromised account under attacker control until the session expires at its 30-day maximum age. This issue is fixed in version 1.0.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-63400")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.