Executive brief
SillyTavern is a user interface for interacting with text-generation AI models. A security flaw exists where changing an account password does not disconnect other active sessions. This means if an attacker manages to steal a user's login cookie, they can maintain permanent access to the account even after the legitimate owner resets their password, potentially exposing private conversations and API keys.
Technical details
SillyTavern utilizes stateless signed cookies via the cookie-session middleware to manage authentication. The application's password change and recovery endpoints (POST /api/users/change-password and POST /api/users/recover-step2) update the password hash in the database but do not implement a mechanism to revoke or expire existing session cookies. Because the session data is stored entirely on the client side, an attacker who has obtained a session cookie (e.g., via XSS or MITM) can continue to authenticate successfully until the cookie's natural expiration, which defaults to 400 days. This vulnerability is classified as CWE-613 (Insufficient Session Expiration). A fix was introduced in version 1.18.0.
Affected products
- SillyTavern SillyTavern <= 1.17.0
Timeline
- 2026-05-11: disclosed
- 2026-05-12: advisory: GitHub Advisory published
- 2026-05-11: patched: Version 1.18.0 released