Security readout for executives and security teams
Plain-English summary
Question2Answer through 1.8.8 may leave stolen or otherwise obtained remember-me cookies valid after an account password reset. An attacker already holding such a cookie could retain authenticated access despite the victim completing account recovery. This undermines password resets as a containment measure and could permit continued account access.
Executive priority
Prioritize remediation for public or sensitive Question2Answer installations. A password reset may not remove an intruder who already possesses a persistent cookie, weakening a standard incident-response control. Invalidate sessions during suspected compromise and deploy the confirmed project correction promptly, while recognizing that no active-exploitation evidence is supplied.
Technical view
The forgot-password handler qa_finish_reset_user() does not clear the user’s sessioncode in qa-include/app/users-edit.php. Consequently, persistent qa_session cookies issued before recovery remain usable. The normal password-change path in qa-include/pages/account.php clears sessioncode, creating inconsistent session invalidation. The supplied CVSS 4.0 score is 9.1 and maps the flaw to CWE-613.
Likely exposure
Internet-accessible Question2Answer deployments through version 1.8.8 are potentially exposed when persistent remember-me cookies have been issued. Actual compromise requires an attacker to have previously obtained a valid cookie. The supplied affected-version metadata is inconsistent, listing version “0,” so administrators should confirm applicability against the CVE record and project guidance.
Exploitation context
The source bundle does not identify known active exploitation, and the CVE is not listed as KEV in the supplied data. Exploitation requires possession of a previously issued persistent cookie; the password-reset workflow then fails to terminate that access. No evidence supplied establishes widespread exploitation or public weaponization.
Researcher notes
The core issue is asymmetric session invalidation between ordinary password changes and forgot-password completion. Analysis should focus on qa_finish_reset_user(), sessioncode lifecycle, and persistent qa_session validation. Pull request 1017 is identified as the patch reference, but the bundle does not name a fixed release. Avoid inferring broader product or version impact.
Mitigation direction
- Review and apply the maintainer’s fix associated with pull request 1017.
- Upgrade when Question2Answer publishes a release containing the confirmed correction.
- Invalidate existing persistent sessions or remember-me cookies across affected deployments.
- Treat password resets alone as insufficient containment for suspected cookie theft.
- Check project guidance for any additional supported remediation or release instructions.
Validation and detection
- Inventory Question2Answer deployments and confirm installed versions.
- Determine whether remember-me functionality has issued persistent qa_session cookies.
- Verify the forgot-password path clears sessioncode after applying remediation.
- Confirm pre-reset persistent sessions no longer authenticate after account recovery.
- Review authentication logs for continued access after password-reset events.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-613: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-64829 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.1 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N——VulnCheckCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N2.25.2VulnCheckVulnerability scoring details
Base CVSS 4.0 score
9.1CriticalVector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Base CVSS 3.1 score
7.4HighVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- Pull RequestCVE reference, VulnCheck · issue-tracking, patch
- https://www.vulncheck.com/advisories/question2answer-session-fixation-via-forgot-password-flowCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Insufficient Session Expiration
Insufficient Session Expiration represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.