Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability description clearly states that the SavePasswordController::handle() method was responsible for calling PasswordToken::findOrFail() without performing expiry validation. The provided commit 2803058d0f9dc38252326070b46d4484fe5a857d directly confirms this by showing the modification in framework/core/src/Forum/Controller/SavePasswordController.php. The change replaces the call to PasswordToken::findOrFail() with PasswordToken::validOrFail(). The validOrFail() method, introduced in the same commit within framework/core/src/User/PasswordToken.php, explicitly adds the necessary expiry check. Therefore, the SavePasswordController::handle() function, in its state before this patch, is the vulnerable function as it directly processed unvalidated, potentially expired, password reset tokens.
Flarum\Forum\Controller\SavePasswordController::handleframework/core/src/Forum/Controller/SavePasswordController.php