CVE-2026-64829 Question2Answer 1.8.8 Session Fixation via Forgot-Password Flow
Attackers with a valid remember-me cookie can retain access after a password reset because the forgot-password flow fails to invalidate the session code.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-64829?
CVE-2026-64829 is a critical authentication bypass vulnerability in q2a question2answer, published on 22 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Question2Answer through 1.8.8 contains a session invalidation vulnerability that allows attackers with a previously obtained remember-me cookie to retain authenticated access by exploiting the forgot-password reset flow's failure to clear the sessioncode field in qa-include/app/users-edit.php. While the normal password-change flow in qa-include/pages/account.php explicitly clears the sessioncode to invalidate persistent qa_session cookies, the forgot-password handler qa_finish_reset_user() omits this step, allowing any valid persistent cookie issued before the reset to continue authenticating the account after the password reset completes.
Weakness: CWE-613
Which versions are affected by CVE-2026-64829?
How do I fix CVE-2026-64829?
No fix has been published for CVE-2026-64829 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-64829 being exploited?
There is no known exploitation of CVE-2026-64829 in the wild and no public exploit code.
Sources
Also known as GHSA-88rm-6cpc-9j4w.