HighVulnerabilityLLM-specific
CVE-2026-44648: SillyTavern session cookies stay valid after password change
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-44648
- Published
- Record updated
- Affected
- sillytavern <= 1.17.0
- Fixed in
- 1.18.0
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.4%
Summary
SillyTavern versions prior to 1.18.0 use cookie-based sessions that store user handle and permissions in a signed client cookie. The endpoints POST /api/users/change-password and POST /api/users/recover-step2 update the password hash but do not expire existing sessions, and because the session is stateless there is no server-side way to revoke an issued token.
Mitigation
Fixed in 1.18.0.
Related items
- MediumWhen LLM Gateways Go Wrong: Findings from LiteLLMSimilar attack · Check Point Research
- HighCVE-2026-109403: conductor-oss conductor server-side request forgery in agent card fetchingSimilar attack · NVD/CVE Database
- InfoExploring Backdoor Vulnerabilities and Fairness Challenges in Generative Models: A SurveySimilar attack · ACM Digital Library (TOPS, DTRAP, CSUR)
- LowSmall AI Models Could Soon Self-Replicate on IoT Devices, Anthropic WarnsSimilar attack · SecurityWeek
- MediumCVE-2026-108940: Mistral.rs path traversal through calibration_apply save_cimatrix argumentSimilar attack · NVD/CVE Database