CVE-2026-84203
Memos versions 0.26.0 through 0.30.0 fail to revoke refresh tokens when a user changes their password, allowing attackers to maintain account access. An attacker with a stolen refresh token can call the RefreshToken RPC to obtain new access tokens and rotate the refresh token indefinitely, bypassing the password change security measure.
Debilidad
Memos versions 0.26.0 through 0.30.0 fail to revoke refresh tokens when a user changes their password, allowing attackers to maintain account access. An attacker with a stolen refresh token can call the RefreshToken RPC to obtain new access tokens and rotate the refresh token indefinitely, bypassing the password change security measure.
Referencias
- https://github.com/usememos/memos
- https://github.com/usememos/memos/blob/v0.30.0/server/auth/authenticator.go
- https://github.com/usememos/memos/blob/v0.30.0/server/router/api/v1/user_service.go
- https://www.vulncheck.com/advisories/memos-0.26.0-through-0.30.0-insufficient-session-expiration-on-password-change
Encuentra el fallo antes que un atacante.
Inicia sesión con GitHub y ejecuta tu primera auditoría en menos de un minuto. El plan gratuito no requiere tarjeta de crédito.