Password Reset Vulnerability in Coop by ROOST

CVE-2026-63400

What is CVE-2026-63400?

Coop, an open-source review and moderation tool developed by ROOST, has a vulnerability in its resetPasswordForToken functionality. Prior to version 1.0.2, this function allows an attacker, who has previously obtained a user's password and established a session, to retain access even after the legitimate user resets the password. The vulnerability arises because the system fails to invalidate the established database-backed session post-password reset. Consequently, compromised accounts remain under the attacker's control until the session naturally expires, which can take up to 30 days. This issue has been addressed in the latest version, 1.0.2, where proper session invalidation mechanisms have been implemented.

References