Flarum before 1.8.16 contains a password reset token expiry bypass vulnerability that allows unauthenticated attackers to reuse expired password reset tokens by…

Flarum versions before 1.8.16 contain a vulnerability allowing unauthenticated attackers to reuse expired password reset tokens. The flaw exists in the SavePasswordController::handle() method, which calls PasswordToken::findOrFail() without performing expiry validation. The 24-hour token lifetime is only enforced during form rendering, not at the reset processing endpoint. An attacker can submit expired tokens directly to the endpoint to reset any account's password. This effectively allows account takeover and gaining an authenticated session. The vulnerability has been patched in Flarum version 1.8.16. A fix was committed to the Flarum framework repository along with a pull request addressing the missing expiry check.