Executive brief
Question2Answer, a popular open-source platform for building Q&A websites, contains a security flaw in its password reset process. When a user resets their password using the 'forgot password' feature, the system fails to invalidate existing 'remember-me' login sessions. This allows an attacker who has previously stolen a login cookie to maintain permanent access to the account even after the legitimate owner changes their password to secure it.
Technical details
A session invalidation vulnerability (CWE-613) exists in Question2Answer through version 1.8.8. The root cause is located in the `qa_finish_reset_user()` handler within `qa-include/app/users-edit.php`, which fails to clear the `sessioncode` field during the forgot-password reset flow. While the standard password change flow in `qa-include/pages/account.php` correctly invalidates persistent sessions, this omission allows any `qa_session` cookie issued prior to the reset to remain valid. An attacker who has obtained a persistent remember-me cookie can maintain authenticated access indefinitely, bypassing the security intent of a password reset. A patch has been proposed in GitHub pull request #1017.
Affected products
- q2a Question2Answer through 1.8.8
Timeline
- 2026-07-22: advisory: NVD and VulnCheck published the advisory
- 2026-07-22: other: Pull request #1017 submitted to fix the issue