Executive brief
Memos is an open-source note-taking application that allows users to store and manage notes. When a user changes their password, the system fails to invalidate previously issued refresh tokens, allowing an attacker with a stolen token to maintain indefinite account access and bypass the password change security measure.
Technical details
This is an authentication bypass vulnerability in Memos versions 0.26.0 through 0.30.0 stemming from incomplete token revocation logic in the password change function. The vulnerable component is the authentication handler in server/auth/authenticator.go, which does not revoke existing refresh tokens when a password change occurs. An attacker who has previously obtained a refresh token (e.g., through theft or phishing) can call the RefreshToken RPC endpoint to obtain new access tokens and rotate the refresh token indefinitely, completely circumventing the intended security benefit of a password change. This attack requires only network access to the Memos API and a valid refresh token; no authentication or user interaction is needed beyond possession of the token. The vulnerability allows persistent account compromise even after a victim changes their password.
Affected products
- Memos Memos 0.26.0 through 0.30.0
Timeline
- 2026-09-01: disclosed