{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-63400","assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","state":"PUBLISHED","assignerShortName":"GitHub_M","dateReserved":"2026-07-16T19:20:28.987Z","datePublished":"2026-10-30T22:46:10.154Z","dateUpdated":"2026-10-30T22:46:10.154Z"},"containers":{"cna":{"title":"Coop sessions are not invalidated on password reset","problemTypes":[{"descriptions":[{"cweId":"CWE-613","lang":"en","description":"CWE-613: Insufficient Session Expiration","type":"CWE"}]}],"metrics":[{"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","baseScore":2.3,"baseSeverity":"LOW","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0"}}],"references":[{"name":"https://github.com/roostorg/coop/security/advisories/GHSA-g5xq-67g7-36r2","tags":["x_refsource_CONFIRM"],"url":"https://github.com/roostorg/coop/security/advisories/GHSA-g5xq-67g7-36r2"},{"name":"https://github.com/roostorg/coop/pull/778","tags":["x_refsource_MISC"],"url":"https://github.com/roostorg/coop/pull/778"},{"name":"https://github.com/roostorg/coop/commit/f226db0fb7f03096d2a832304ad9614e944e4bf8","tags":["x_refsource_MISC"],"url":"https://github.com/roostorg/coop/commit/f226db0fb7f03096d2a832304ad9614e944e4bf8"},{"name":"https://github.com/roostorg/coop/releases/tag/1.0.2","tags":["x_refsource_MISC"],"url":"https://github.com/roostorg/coop/releases/tag/1.0.2"}],"affected":[{"vendor":"roostorg","product":"coop","versions":[{"version":"< 1.0.2","status":"affected"}]}],"providerMetadata":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-30T22:46:10.154Z"},"descriptions":[{"lang":"en","value":"Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, `resetPasswordForToken` updates the password row without invalidating database-backed sessions. An attacker who has acquired a password and established a session retains access even after the legitimate user resets the password, leaving the compromised account under attacker control until the session expires at its `30-day` maximum age. This issue is fixed in version 1.0.2."}],"source":{"advisory":"GHSA-g5xq-67g7-36r2","discovery":"UNKNOWN"}}}}