Session Invalidation Flaw in Question2Answer by Q2A Team
CVE-2026-64829

9.1CRITICAL

Key Information:

Vendor

Q2a

Status
Question2answer
Vendor
CVE Published:
22 July 2026

What is CVE-2026-64829?

A session invalidation issue in Question2Answer versions up to 1.8.8 allows attackers to exploit the forgot-password reset flow. By not clearing the sessioncode field during this process, previously obtained remember-me cookies remain active even after a password reset, enabling unauthorized access. While the password change process correctly invalidates these cookies, the forgot-password handler fails to do so, posing a risk to account security.

Affected Version(s)

question2answer 0 <= 1.8.8

References

https://github.com/q2a/question2answer/pull/1017
issue-tracking
https://www.vulncheck.com/advisories/question2answer-sess...
third-party-advisory

CVSS V4

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Shahrul Nizam Bin Shahrin
.