Back to overview

CVE-2026-44648

HIGH Exploitation: PoC
7.5
CVSS 3.1
Description
SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to 1.18.0, SillyTavern relies on cookie-session for authentication, storing all session data (user handle, permissions) in a signed cookie. The endpoints POST /api/users/change-password and POST /api/users/recover-step2 only update the password hash in the database but do not expire current sessions. Because the session is stateless and stored entirely in the client cookie, there is no server-side mechanism to revoke a token once issued. This vulnerability is fixed in 1.18.0.

Metadata

CVE ID
CVE-2026-44648
State
PUBLISHED
Assigner
GitHub_M
Reserved
2026-05-07 15:30 UTC
Published
2026-05-29 17:46 UTC
Last updated
2026-05-29 19:47 UTC
Primary CWE
CWE-613
CWE-613: Insufficient Session Expiration
Vendor / Product
SillyTavern / SillyTavern
Sources
cve.org  ·  NVD

Severity & Metrics

7.5 HIGH CVSS 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
SSVC — CISA Coordinator
Exploitation
PoC
Automatable
no
Tech. Impact
total
Affected products (1)
VendorProductPlatformVersions
SillyTavern SillyTavern — < 1.18.0
Weakness (CWE)
CWESourceDescription
CWE-613 cna CWE-613: Insufficient Session Expiration
CVSS scores (1)
ScoreSeverityVersionSourceVector
7.5 HIGH 3.1 cna CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
References (1)
Back to overview