Description
Memos versions 0.26.0 through 0.30.0 fail to revoke refresh tokens when a user changes their password, allowing attackers to maintain account access. An attacker with a stolen refresh token can call the RefreshToken RPC to obtain new access tokens and rotate the refresh token indefinitely, bypassing the password change security measure.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
usememos memos
Default version status: unaffected
0.26.0 to ≤ 0.30.0affected
pkg:github/usememos/memosReferences
- https://github.com/usememos/memos ↗
- https://github.com/usememos/memos/blob/v0.30.0/server/router/api/v1/user_service.go ↗
- https://github.com/usememos/memos/blob/v0.30.0/server/auth/authenticator.go ↗
- https://www.vulncheck.com/advisories/memos-0.26.0-through-0.30.0-insufficient-session-expiration-on-password-change ↗