Authentication Flaw in SillyTavern User Interface by SillyTavern

CVE-2026-44648

What is CVE-2026-44648?

SillyTavern, a locally installed user interface designed for interaction with various AI models, contains a vulnerability that impacts its authentication mechanism. Prior to version 1.18.0, the application relied on cookie-session for managing user sessions, leading to potential security implications. The endpoints responsible for password changes do not effectively expire existing sessions, allowing a user to retain access after a password update. Since the session data is stored solely in a signed cookie on the client-side without server-side controls, there is no means for the server to invalidate previously issued tokens. This flaw could enable session hijacking, posing significant risks to the affected users.

References