CVE-2026-39924 is an insufficient session expiration vulnerability in Flarum Framework before version 1.8.16. The flaw arises because the TokensClearer::clearPasswordTokens() function only removes entries from the password_tokens table but does not clear the access_tokens table. As a result, valid session tokens, including long-lived session cookies and API bearer tokens, remain active after password changes or administrator-forced resets. This allows attackers with valid session tokens to retain full account access despite password updates.

Attackers who have obtained valid session tokens can continue to access user accounts even after the password is changed, bypassing the intended security measure of invalidating sessions upon password updates. This undermines account security and can lead to unauthorized persistent access, including for accounts with administrative privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider additional manual session invalidation measures or monitor for suspicious session activity. Avoid relying solely on password changes to revoke active sessions.