SillyTavern, a locally installed UI for interacting with AI models, contains a session management vulnerability in versions prior to 1.18.0. The application uses cookie-based authentication storing session data in signed cookies. When users change passwords or recover accounts via specific API endpoints, existing sessions are not invalidated. Since sessions are stateless and stored client-side, there is no server-side mechanism to revoke active sessions, allowing unauthorized access to continue even after password changes. This vulnerability has been addressed in version 1.18.0.