{"id":"CVE-2026-64829","summary":"Question2Answer 1.8.8 Session Fixation via Forgot-Password Flow","details":"Question2Answer through 1.8.8 contains a session invalidation vulnerability that allows attackers with a previously obtained remember-me cookie to retain authenticated access by exploiting the forgot-password reset flow's failure to clear the sessioncode field in qa-include/app/users-edit.php. While the normal password-change flow in qa-include/pages/account.php explicitly clears the sessioncode to invalidate persistent qa_session cookies, the forgot-password handler qa_finish_reset_user() omits this step, allowing any valid persistent cookie issued before the reset to continue authenticating the account after the password reset completes.","modified":"2026-07-25T04:14:49.805409542Z","published":"2026-07-22T19:57:29.754Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-613"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64829.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64829.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64829"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/question2answer-session-fixation-via-forgot-password-flow"},{"type":"FIX","url":"https://github.com/q2a/question2answer/pull/1017"},{"type":"PACKAGE","url":"https://github.com/q2a/question2answer"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/q2a/question2answer","events":[{"introduced":"0"},{"fixed":"5a43593b39778adc4331fdb3f23f7d81fe73e72f"}],"database_specific":{"source":["AFFECTED_FIELD","DESCRIPTION"],"extracted_events":[{"introduced":"0"},{"last_affected":"1.8.8"},{"introduced":"Question2Answer"},{"fixed":"1.8.8"}]}}],"versions":["v1.8.7","v1.8.6","v1.8.5","v1.8.4","v1.8.3","v1.8.2","v1.8.1","v1.8.0","v1.8.0-beta2","v1.8.0-beta1","v1.7.0","v1.7-beta","v1.6.3","v1.5.4"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64829.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}]}