CVE-2026-39923 describes a password reset token expiry bypass in Flarum Framework before version 1.8.16. The SavePasswordController::handle() method calls PasswordToken::findOrFail() without verifying whether the token has expired. While the token lifetime is enforced during the rendering of the reset form, the absence of expiry validation during token processing allows attackers to submit expired tokens directly to the reset endpoint. This enables an unauthenticated attacker to reset any account's password and obtain an authenticated session.

An unauthenticated attacker can reuse expired password reset tokens to change any user's password and gain unauthorized authenticated access to the affected Flarum Framework application. This compromises user accounts and potentially the entire application security. The vulnerability has a CVSS 4.0 score of 9.2, indicating critical severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using affected versions and consider disabling password reset functionality or implementing additional validation on password reset tokens to ensure expiry is enforced during token processing.