Description

Memos versions 0.26.0 through 0.30.0 fail to revoke refresh tokens when a user changes their password, allowing attackers to maintain account access. An attacker with a stolen refresh token can call the RefreshToken RPC to obtain new access tokens and rotate the refresh token indefinitely, bypassing the password change security measure.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-09-01T16:17:34.600Z",
  "pubdate": "2026-09-01T16:17:34.600Z",
  "executiveSummary": "This vulnerability involves a failure in the Memos authentication mechanism to invalidate existing refresh tokens upon a user password change. Affecting versions 0.26.0 through 0.30.0, this flaw creates a security bypass scenario where an attacker possessing a compromised refresh token maintains persistent unauthorized access to the victim's account.\nThe vulnerability type is categorized as Improper Authentication/Session Management. By failing to terminate sessions associated with older credentials, the application violates the security principle that password resets should invalidate all active sessions. This enables attackers to bypass security measures and maintain access indefinitely by continuously rotating tokens through the RefreshToken RPC.\nThe risk implication is critical, as it undermines the primary defensive mechanism for account recovery after a compromise. Attackers do not require further interaction with the victim, only an existing stolen token. Organizations using Memos in the affected version range face significant threats to data confidentiality and integrity until patches are applied or session invalidation is forced.\nExploitation does not require elevated privileges beyond the possession of a valid, pre-compromised refresh token, which can be acquired via session hijacking or cross-site scripting (XSS) in environments where tokens are stored insecurely.",
  "technicalDetails": "The root cause of this vulnerability lies in the lack of a server-side state linkage between user credentials and issued refresh tokens within the Memos authentication subsystem. When a user updates their account password, the application backend fails to trigger a corresponding revocation process for existing refresh tokens associated with the user's account ID.\nThe vulnerable component is the authentication service responsible for handling the RefreshToken RPC calls. In versions 0.26.0 through 0.30.0, the RefreshToken RPC function logic independently validates the provided refresh token against the storage backend without checking for subsequent security events, such as password modifications, that should render the token stale.\nThe attack flow proceeds as follows: First, an attacker exfiltrates a valid refresh token from an authenticated user. Second, the legitimate user, becoming aware of a security compromise or performing routine maintenance, changes their password in Memos. Third, while the user expects this action to log out all sessions, the application retains the attacker's stolen refresh token as valid. Fourth, the attacker invokes the RefreshToken RPC, presenting the stolen token. The server, failing to verify if the token was issued prior to the password reset, issues a fresh pair of access and refresh tokens. This effectively rotates the token and resets the expiration window, allowing the attacker to maintain persistent, unauthorized access indefinitely.\nThis persistence mechanism bypasses standard security lifecycle management. Because the token rotation logic replaces the old refresh token with a new one upon every successful RPC call, the attacker effectively stays one step ahead of expiration timers. There is no requirement for further authentication or network-level exploits, as the server treats the compromised token as an authenticated state indefinitely. Post-exploitation, the attacker maintains the full scope of access permissions held by the original user, facilitating unauthorized data access, modifications, or administrative actions within the Memos platform."
}