High-Severity Memos Flaw (CVE-2024-21635) Allows Hackers to Stay Logged In After Password Change

The article reports that CVE-2024-21635 affects Memos, a privacy-first, self-hosted knowledge base, with a CVSS score of 7.1 placing it in the high-severity category. It explains that the flaw lies in how Access Tokens are managed: when a user changes their password, the existing tokens stay valid, allowing an attacker who already holds a token to remain logged in.

The advisory describes a simple PoC across two devices showing that a password change on one device does not log out the other, and that the token list is hard to audit due to a generic description. The vulnerability affects all builds up to and including v0.18.1, with the latest stable release at v0.25.2 containing the fix, which revokes all existing tokens upon a password change.

The Memos team states that all Access Tokens must be revoked when a user changes their password, aligning with standard authentication practices and preventing lingering access after credential updates.