2.3
LowCVSS 4.0 · from GitHub_M
CVE-2026-63400
Coop sessions are not invalidated on password reset
coop · CWE-613 · CWE-613Affectedcoop
FixNo fix listed yet.
PublishedOct 30, 22:46 · GitHub_M
ScoredOct 30 · 2.3 · GitHub_M
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:07 UTC
What we know
No known exploitation. CISA KEV, checked 22:07 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, low privileges.
It only works under certain conditions, which makes it harder to pull off. CVSS: high attack complexity.
Description
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, `resetPasswordForToken` updates the password row without invalidating database-backed sessions. An attacker who has acquired a password and established a session retains access even after the legitimate user resets the password, leaving the compromised account under attacker control until the session expires at its `30-day` maximum age. This issue is fixed in version 1.0.2.
From GitHub_M
Affected and fixed versions
ProductAffectedFixed incoop< 1.0.2–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known