CVE-2026-39923 is a vulnerability in Flarum Framework before version 1.8.16 where the SavePasswordController::handle() method calls PasswordToken::findOrFail() without validating token expiry. Although the password reset token is intended to expire after 24 hours, this expiry is only checked during the rendering of the reset form, not during the actual reset processing. Consequently, an attacker can submit an expired token directly to the reset endpoint and successfully reset the password of any account, thereby gaining unauthorized authenticated sessions.

An unauthenticated attacker can bypass the intended 24-hour expiration of password reset tokens and reset passwords for arbitrary user accounts. This leads to unauthorized account takeover and full authenticated access to affected accounts. The vulnerability is rated critical with a CVSS 4.0 score of 9.2, indicating high impact on confidentiality, integrity, and availability.

No official patch or remediation level has been confirmed at this time. Users of Flarum Framework should upgrade to version 1.8.16 or later once available, as this version presumably addresses the issue. Until a fix is applied, restrict access to the password reset endpoint if possible and monitor for suspicious activity related to password resets. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.