CVE-2026-63400

— UNSCOREDpublic exploit available

Published 2026-10-30 · Updated 2026-10-30

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, `resetPasswordForToken` updates the password row without invalidating database-backed sessions. An attacker who has acquired a password and established a session retains access even after the legitimate user resets the password, leaving the compromised account under attacker control until the session expires at its `30-day` maximum age. This issue is fixed in version 1.0.2.

Weaknesses

CWE-613

Public exploit & PoC references

https://github.com/roostorg/coop/commit/f226db0fb7f03096d2a832304ad9614e944e4bf8
https://github.com/roostorg/coop/pull/778
https://github.com/roostorg/coop/releases/tag/1.0.2
https://github.com/roostorg/coop/security/advisories/GHSA-g5xq-67g7-36r2

All references

https://github.com/roostorg/coop/commit/f226db0fb7f03096d2a832304ad9614e944e4bf8
https://github.com/roostorg/coop/pull/778
https://github.com/roostorg/coop/releases/tag/1.0.2
https://github.com/roostorg/coop/security/advisories/GHSA-g5xq-67g7-36r2

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2024-8122
UNSCOREDCVE-2025-0326
MEDIUMCVE-2025-13173
MEDIUMCVE-2025-36069
MEDIUMCVE-2025-36252
MEDIUMCVE-2025-71435PoC
MEDIUMCVE-2026-100502PoC
MEDIUMCVE-2026-100554PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.