The vulnerability CVE-2026-1163 in parisneo/lollms involves insufficient session expiration (CWE-613). After a user resets their password, the application does not invalidate existing active sessions, allowing an attacker with access to an old session token to maintain persistent access to the compromised account. This is compounded by the absence of session invalidation after inactivity and a default session duration of 31 days, increasing the window of opportunity for unauthorized access. The CVSS 3.0 base score is 4.1 (medium), reflecting network attack vector, high attack complexity, high privileges required, no user interaction, and low impact on confidentiality, integrity, and availability. No patch or official remediation guidance has been published yet.

An attacker who has obtained an active session token prior to a password reset can continue to access the compromised account despite the password change. This undermines the security benefit of password resets and allows persistent unauthorized access. The impact is limited to low confidentiality, integrity, and availability loss, consistent with the medium CVSS score. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users and administrators should consider manually invalidating all active sessions upon password resets if possible, and reducing session duration to limit exposure. Monitoring for unusual session activity may help detect exploitation attempts.