CVE-2026-44648: SillyTavern: Existing sessions are not invalidated after password change, allowing session reuse and account takeover

Synopsis

Session fixation flaw in SillyTavern where existing sessions remain valid after a password change or recovery, enabling account takeover by anyone holding a previously issued session cookie. The bug is reachable over the network without authentication but requires user interaction and unusual conditions for an attacker to obtain a valid prior session, and successful exploitation allows full read, write, and disruption of the victim account. A patched-image rebuild at 1.18.0 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the SillyTavern web interface over the network to replay the captured session cookie.

• AuthenticationNot required

  No prior login to the target account is needed; the attacker reuses an existing session cookie rather than authenticating.

• Victim interactionRequired

  The victim must take an action that exposes or shares a session cookie (for example using a shared device or leaking the cookie through another channel) for the attacker to capture it.

• Attack complexityDetail

  Attack complexity is high because the attacker needs to obtain a valid prior session cookie, which depends on environmental factors outside the attacker's direct control.

Blast Radius

• Reads all data accessible to the victim account, including chat history, stored prompts, and any configured API credentials for connected LLM, image, and voice backends.
• Modifies the victim's stored configuration, personas, and saved conversations, and can change account settings under the victim's identity.
• Disrupts the victim's use of the service by altering or deleting their data, and retains access even after the victim changes their password to try to lock the attacker out.