This vulnerability (CVE-2026-1163) in parisneo/lollms arises from insufficient session expiration controls (CWE-613). The application fails to invalidate existing session tokens upon password reset, combined with a lack of inactivity timeout and a default session duration of 31 days. This allows an attacker to reuse an old session token to maintain access to an account despite password changes. The CVSS 3.0 score is 4.1 (medium), reflecting network attack vector, high attack complexity, high privileges required, no user interaction, and low impact on confidentiality, integrity, and availability. No patch or official remediation is currently documented.

The vulnerability allows an attacker who has obtained a valid session token to maintain persistent access to a compromised account even after the legitimate user resets their password. This undermines the effectiveness of password resets as a security measure to terminate unauthorized access. The impact is limited to low confidentiality, integrity, and availability loss as per the CVSS vector, but it poses a risk of prolonged unauthorized account access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to implement manual session invalidation upon password reset if possible, reduce session duration, and monitor for suspicious session reuse. Avoid relying solely on password resets to terminate active sessions.