Memos versions 0.26.0 through 0.30.0 contain a vulnerability where refresh tokens are not invalidated when a user changes their password. This allows an attacker who has obtained a refresh token to continue generating valid access tokens indefinitely via the RefreshToken RPC, effectively bypassing the security intent of a password change. The vulnerability is classified as Insufficient Session Expiration. An attacker maintaining a stolen refresh token can rotate it perpetually, preserving unauthorized account access even after the legitimate user has updated their credentials. The issue is documented in the Memos authenticator and user service source files. A fix requires implementing token revocation logic tied to password change events.
