Session Expiration Flaw in Parisneo Lollms Application

CVE-2026-1163

What is CVE-2026-1163?

An insufficient session expiration vulnerability in the latest version of the Parisneo Lollms application allows attackers to exploit active sessions after a password reset. This occurs because the application fails to invalidate old session tokens, enabling unauthorized access. The vulnerability is exacerbated by a long default session duration of 31 days and a lack of mechanisms to reject requests after a specified period of inactivity. Consequently, attackers can maintain access to a compromised account even if the legitimate user updates their password.

References