parisneo/lollms has an insufficient session expiration vulnerability

The primary impact of CVE-2026-1163 is the potential for persistent unauthorized access. An attacker who has gained initial access to an account, even temporarily, can leverage this vulnerability to maintain that access indefinitely, bypassing password reset attempts. This allows them to perform actions on behalf of the compromised user, potentially including data exfiltration, modification of sensitive information, or further lateral movement within the system. The blast radius extends to any data or resources accessible by the compromised user account.

Organizations deploying lollms in production environments, particularly those with sensitive data or critical infrastructure managed through the application, are at risk. Shared hosting environments where multiple users share the same lollms instance are also particularly vulnerable, as a compromise of one account could potentially lead to persistent access for the attacker.

• python / server:

import requests
import time

# Replace with your lollms instance URL
base_url = "http://your-lollms-instance"

# Get a session token (assuming you have a valid login)
# This is a placeholder - replace with your actual authentication flow
session_token = "your_session_token"

# Reset the password (assuming you have the necessary credentials)
password_reset_url = f"{base_url}/password_reset"
password_reset_data = {"email": "[email protected]"}
response = requests.post(password_reset_url, json=password_reset_data)

# Wait a few seconds for the password reset to complete
time.sleep(5)

# Attempt to use the old session token after the password reset
headers = {"Authorization": f"Bearer {session_token}"}
response = requests.get(f"{base_url}/protected_resource", headers=headers)

if response.status_code == 200:
    print("Old session token still valid after password reset - Vulnerability Detected!")
else:
    print("Old session token invalidated - No Vulnerability Detected.")

1. 2026-04-07Disclosure

   disclosure

1. Reservado2026-01-18
2. Publicada2026-04-07
3. Modificada2026-04-08
4. EPSS atualizado2026-04-15

The primary mitigation for CVE-2026-1163 is to upgrade lollms to a version greater than 11.0.0, which includes the necessary session expiration fixes. If an immediate upgrade is not feasible, consider implementing temporary workarounds. These may include shortening the default session duration to a more reasonable timeframe (e.g., 15-30 minutes) and implementing stricter session invalidation policies after password resets. Monitor application logs for suspicious activity related to session management. After upgrading, confirm session expiration is functioning correctly by resetting a password and verifying the old session token is invalidated.