Description
Changing a user’s password does not invalidate existing sessions, allowing an attacker with a stolen cookie to retain access even after the victim resets their password.
Recommendation
Update the sillytavern package to the latest compatible version. Followings are version details:
- Affected version(s): <= 1.17.0
- Patched version(s): 1.18.0
References
Could your website be exposed too?
SmartScanner can check your website for SillyTavern: Existing sessions are not invalidated after password change, allowing session reuse and account takeover and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Strapi: Password Reset Does Not Revoke Existing Refresh Sessions - CVE-2026-22706
- Strapi: Password Reset Does Not Revoke Existing Refresh Sessions - @strapi/plugin-users-permissions - CVE-2026-22706
- Payload: Pre-Authentication Account Takeover via Parameter Injection in Password Recovery - payload - CVE-2026-34751
- Payload: Pre-Authentication Account Takeover via Parameter Injection in Password Recovery - CVE-2026-34751
You might also like:
See something that needs correcting? Let us knowUpdated June 09, 2026