CVE-2026-39924 describes an improper session invalidation vulnerability in Flarum Framework before version 1.8.16. The issue arises because the TokensClearer::clearPasswordTokens() function only clears entries from the password_tokens table but does not clear the access_tokens table. As a result, active session cookies and API bearer tokens remain valid after a password change, allowing attackers with a valid session token to retain full account access. This flaw also affects administrator-forced password resets via the user update endpoint, which fail to revoke existing sessions.

Attackers who have obtained a valid session token can continue to access the victim's account even after the victim changes their password or an administrator forces a password reset. This undermines the security benefits of password changes and resets, potentially allowing persistent unauthorized access to user accounts, including those with elevated privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider invalidating all active sessions manually after password changes or resets, if possible. Monitoring for suspicious session activity and enforcing shorter session lifetimes may help reduce risk.