Coop sessions are not invalidated on password reset
Coop versions prior to 1.0.2 keep existing sessions valid after a password reset. CVSS rates it Low. Fixed in 1.0.2.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Fix
- Fixed in 1.0.2
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Coop, an open source review and moderation tool from ROOST, is affected. If an attacker has obtained a user's password and logged in, that session stays valid after the user resets their password, so the attacker can keep control of the account for up to 30 days.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, `resetPasswordForToken` updates the password row without invalidating database-backed sessions. An attacker who has acquired a password and established a session retains access even after the legitimate user resets the password, leaving the compromised account under attacker control until the session expires at its `30-day` maximum age. This issue is fixed in version 1.0.2.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- roostorg coop
fixed in 1.0.2
References 4
GitHub · roostorg/coop
Questions about CVE-2026-63400
What does this mean?
Coop does not end existing login sessions when a user resets their password. Someone who already had the password and a session keeps account access until that session expires, which can take up to 30 days.Source: github.com
Am I affected, and how do I check?
Coop versions prior to 1.0.2 are affected. Sessions are stored in the database with a 30-day maximum age, so the exposure window lasts up to that long. To check the version, look at the installed Coop release.Source: github.com
What should I do about it?
Upgrade Coop to 1.0.2 or later, which is the patched version. The sources do not list a workaround.Source: github.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data