Vulnerability-Lookup

GHSA-CQ9C-6W48-QMFG

Vulnerability from github – Published: 2026-06-22 23:19 – Updated: 2026-06-22 23:19

Summary

@actual-app/sync-server: Disabled OpenID users keep access through existing session tokens

Details

Summary

In OpenID multi-user mode, disabling a user only blocks future OpenID login for that identity. Existing Actual session tokens for the disabled user remain valid, so the user can continue calling authenticated server endpoints after an administrator has disabled the account.

Details

The disabled-user check is present during OpenID login finalization. Existing users are only accepted when the matching row has enabled = 1, and a disabled row causes the OpenID grant to fail before a new session token is created.

// packages/sync-server/src/accounts/openid.ts:284-291
const { id: userIdFromDb, display_name: displayName } =
  accountDb.first(
    'SELECT id, display_name FROM users WHERE user_name = ? and enabled = 1',
    [identity],
  ) || {};

if (userIdFromDb == null) {
  throw new Error('openid-grant-failed');
}

The shared session validation path does not perform the same enabled-user check. It accepts any existing token row that has not expired, then returns the session object to every route protected by validateSessionMiddleware.

// packages/sync-server/src/util/validate-user.ts:10-41
export function validateSession(req: Request, res: Response) {
  let { token } = req.body || {};
  if (!token) {
    token = req.headers['x-actual-token'];
  }

  const session = getSession(token);
  ...
  return session;
}

This means account disablement and session authorization diverge:

OpenID login path: users.enabled must be 1
Existing session path: token exists and is not expired; users.enabled is not checked

The default token expiration setting is never, so this is not just a short race after disablement on default deployments.

// packages/sync-server/src/load-config.js:260-264
token_expiration: {
  doc: 'Token expiration time.',
  format: 'tokenExpiration',
  default: 'never',
  env: 'ACTUAL_TOKEN_EXPIRATION',
},

Admins can change a user's enabled state through the user update route, but that update does not delete the user's existing sessions. After the update, the old token still satisfies validateSession.

// packages/sync-server/src/app-admin.js:91-101
app.patch('/users', validateSessionMiddleware, async (req, res) => {
  if (!isAdmin(res.locals.user_id)) {
    ...
  }

  const { id, userName, role, displayName, enabled } = req.body || {};

// packages/sync-server/src/services/user-service.ts:98-102
getAccountDb().mutate(
  'UPDATE users SET user_name = ?, display_name = ?, enabled = ?, role = ? WHERE id = ?',
  [userName, displayName, enabled, roleId, userId],
);

Authenticated server features then continue to trust that session. For example, the sync API installs validateSessionMiddleware for the whole router, so a disabled user can keep using any sync operation that their still-valid session and existing file ownership/access allow.

// packages/sync-server/src/app-sync.ts:37-39
const app = express();
app.use(validateSessionMiddleware);
app.use(errorMiddleware);

This is distinct from the previously published cross-user sync authorization issue: the attacker does not need to access another user's file ID. The bypass is that a disabled user's own session remains authorized after account disablement.

PoC

Run an Actual Sync Server in OpenID multi-user mode with @actual-app/sync-server 26.5.0. Use the default token expiration setting, or any setting where the token has not expired yet.
Log in as a non-admin OpenID user and save the returned Actual session token.
As an admin, disable that same user through PATCH /admin/users by sending enabled: false.
Reuse the old token against a protected endpoint.

Example success check:

curl -s https://actual.example.com/account/validate \
  -H 'X-Actual-Token: <disabled_user_existing_token>'

Expected result on the affected code path: the request is still treated as authenticated and returns the disabled user's account/session information instead of 401 or 403.

A sync-facing check uses the same session validation primitive:

curl -s https://actual.example.com/sync/list-user-files \
  -H 'X-Actual-Token: <disabled_user_existing_token>'

Expected result on the affected code path: the disabled user can still list and operate on budget files that the stale session is otherwise allowed to access.

Impact

A disabled OpenID user can keep post-authentication access until the session row is deleted or expires. With the default token_expiration: never, this can persist indefinitely.

For a disabled basic user, the confirmed impact is continued access to that user's own budgets and any budgets shared with that user, including sensitive financial data and allowed mutations. For a disabled admin user, the impact is broader because the existing token can still satisfy admin role checks; that condition preserves administrative access after the account was disabled.

The missing rule is that session validation should reject disabled users, and disabling or deleting a user should revoke that user's existing sessions.

Severity

8.3 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 26.5.2"
      },
      "package": {
        "ecosystem": "npm",
        "name": "@actual-app/sync-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "26.6.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-49229"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-22T23:19:56Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n\nIn OpenID multi-user mode, disabling a user only blocks future OpenID login for that identity. Existing Actual session tokens for the disabled user remain valid, so the user can continue calling authenticated server endpoints after an administrator has disabled the account.\n\n### Details\n\nThe disabled-user check is present during OpenID login finalization. Existing users are only accepted when the matching row has `enabled = 1`, and a disabled row causes the OpenID grant to fail before a new session token is created.\n\n```ts\n// packages/sync-server/src/accounts/openid.ts:284-291\nconst { id: userIdFromDb, display_name: displayName } =\n  accountDb.first(\n    \u0027SELECT id, display_name FROM users WHERE user_name = ? and enabled = 1\u0027,\n    [identity],\n  ) || {};\n\nif (userIdFromDb == null) {\n  throw new Error(\u0027openid-grant-failed\u0027);\n}\n```\n\nThe shared session validation path does not perform the same enabled-user check. It accepts any existing token row that has not expired, then returns the session object to every route protected by `validateSessionMiddleware`.\n\n```ts\n// packages/sync-server/src/util/validate-user.ts:10-41\nexport function validateSession(req: Request, res: Response) {\n  let { token } = req.body || {};\n  if (!token) {\n    token = req.headers[\u0027x-actual-token\u0027];\n  }\n\n  const session = getSession(token);\n  ...\n  return session;\n}\n```\n\nThis means account disablement and session authorization diverge:\n\n```text\nOpenID login path: users.enabled must be 1\nExisting session path: token exists and is not expired; users.enabled is not checked\n```\n\nThe default token expiration setting is `never`, so this is not just a short race after disablement on default deployments.\n\n```js\n// packages/sync-server/src/load-config.js:260-264\ntoken_expiration: {\n  doc: \u0027Token expiration time.\u0027,\n  format: \u0027tokenExpiration\u0027,\n  default: \u0027never\u0027,\n  env: \u0027ACTUAL_TOKEN_EXPIRATION\u0027,\n},\n```\n\nAdmins can change a user\u0027s enabled state through the user update route, but that update does not delete the user\u0027s existing sessions. After the update, the old token still satisfies `validateSession`.\n\n```js\n// packages/sync-server/src/app-admin.js:91-101\napp.patch(\u0027/users\u0027, validateSessionMiddleware, async (req, res) =\u003e {\n  if (!isAdmin(res.locals.user_id)) {\n    ...\n  }\n\n  const { id, userName, role, displayName, enabled } = req.body || {};\n```\n\n```ts\n// packages/sync-server/src/services/user-service.ts:98-102\ngetAccountDb().mutate(\n  \u0027UPDATE users SET user_name = ?, display_name = ?, enabled = ?, role = ? WHERE id = ?\u0027,\n  [userName, displayName, enabled, roleId, userId],\n);\n```\n\nAuthenticated server features then continue to trust that session. For example, the sync API installs `validateSessionMiddleware` for the whole router, so a disabled user can keep using any sync operation that their still-valid session and existing file ownership/access allow.\n\n```ts\n// packages/sync-server/src/app-sync.ts:37-39\nconst app = express();\napp.use(validateSessionMiddleware);\napp.use(errorMiddleware);\n```\n\nThis is distinct from the previously published cross-user sync authorization issue: the attacker does not need to access another user\u0027s file ID. The bypass is that a disabled user\u0027s own session remains authorized after account disablement.\n\n### PoC\n\n1. Run an Actual Sync Server in OpenID multi-user mode with `@actual-app/sync-server` 26.5.0. Use the default token expiration setting, or any setting where the token has not expired yet.\n2. Log in as a non-admin OpenID user and save the returned Actual session token.\n3. As an admin, disable that same user through `PATCH /admin/users` by sending `enabled: false`.\n4. Reuse the old token against a protected endpoint.\n\nExample success check:\n\n```bash\ncurl -s https://actual.example.com/account/validate \\\n  -H \u0027X-Actual-Token: \u003cdisabled_user_existing_token\u003e\u0027\n```\n\nExpected result on the affected code path: the request is still treated as authenticated and returns the disabled user\u0027s account/session information instead of `401` or `403`.\n\nA sync-facing check uses the same session validation primitive:\n\n```bash\ncurl -s https://actual.example.com/sync/list-user-files \\\n  -H \u0027X-Actual-Token: \u003cdisabled_user_existing_token\u003e\u0027\n```\n\nExpected result on the affected code path: the disabled user can still list and operate on budget files that the stale session is otherwise allowed to access.\n\n### Impact\n\nA disabled OpenID user can keep post-authentication access until the session row is deleted or expires. With the default `token_expiration: never`, this can persist indefinitely.\n\nFor a disabled basic user, the confirmed impact is continued access to that user\u0027s own budgets and any budgets shared with that user, including sensitive financial data and allowed mutations. For a disabled admin user, the impact is broader because the existing token can still satisfy admin role checks; that condition preserves administrative access after the account was disabled.\n\nThe missing rule is that session validation should reject disabled users, and disabling or deleting a user should revoke that user\u0027s existing sessions.",
  "id": "GHSA-cq9c-6w48-qmfg",
  "modified": "2026-06-22T23:19:56Z",
  "published": "2026-06-22T23:19:56Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/actualbudget/actual/security/advisories/GHSA-cq9c-6w48-qmfg"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/actualbudget/actual"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "@actual-app/sync-server: Disabled OpenID users keep access through existing session tokens"
}

GHSA-CRF4-J4G9-P5F8

Vulnerability from github – Published: 2024-05-14 18:30 – Updated: 2024-07-03 18:41

Details

An issue in SurveyKing v1.3.1 allows attackers to execute a session replay attack after a user changes their password.

Severity

4.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-35048"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-14T15:39:38Z",
    "severity": "MODERATE"
  },
  "details": "An issue in SurveyKing v1.3.1 allows attackers to execute a session replay attack after a user changes their password.",
  "id": "GHSA-crf4-j4g9-p5f8",
  "modified": "2024-07-03T18:41:11Z",
  "published": "2024-05-14T18:30:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-35048"
    },
    {
      "type": "WEB",
      "url": "https://github.com/javahuang/SurveyKing/issues/56"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-CVG9-CJ93-X2H9

Vulnerability from github – Published: 2022-03-02 00:00 – Updated: 2022-03-17 00:04

Details

IBM MQ Appliance 9.2 CD and 9.2 LTS does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 212942.

Severity

5.4 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2021-38986"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-03-01T17:15:00Z",
    "severity": "MODERATE"
  },
  "details": "IBM MQ Appliance 9.2 CD and 9.2 LTS does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 212942.",
  "id": "GHSA-cvg9-cj93-x2h9",
  "modified": "2022-03-17T00:04:27Z",
  "published": "2022-03-02T00:00:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-38986"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/212942"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/6560032"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-CW7P-Q79F-M2V7

Vulnerability from github – Published: 2021-11-08 18:02 – Updated: 2024-09-24 20:50

Summary

incomplete JupyterHub logout with simultaneous JupyterLab sessions

Details

Impact

Users of JupyterLab with JupyterHub who have multiple JupyterLab tabs open in the same browser session, may see incomplete logout from the single-user server, as fresh credentials (for the single-user server only, not the Hub) reinstated after logout, if another active JupyterLab session is open while the logout takes place.

Patches

Upgrade to JupyterHub 1.5. For distributed deployments, it is jupyterhub in the user environment that needs patching. There are no patches necessary in the Hub environment.

Workarounds

The only workaround is to make sure that only one JupyterLab tab is open when you log out.

Severity

3.5 (Low)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

5.1 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "jupyterhub"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.0.0"
            },
            {
              "fixed": "1.5.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-41247"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-11-04T17:49:19Z",
    "nvd_published_at": "2021-11-04T18:15:00Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nUsers of JupyterLab with JupyterHub who have multiple JupyterLab tabs open in the same browser session, may see incomplete logout from the single-user server, as fresh credentials (for the single-user server only, not the Hub) reinstated after logout, if another active JupyterLab session is open while the logout takes place.\n\n### Patches\n\nUpgrade to JupyterHub 1.5. For distributed deployments, it is jupyterhub in the _user_ environment that needs patching. There are no patches necessary in the Hub environment.\n\n### Workarounds\n\nThe only workaround is to make sure that only one JupyterLab tab is open when you log out.",
  "id": "GHSA-cw7p-q79f-m2v7",
  "modified": "2024-09-24T20:50:54Z",
  "published": "2021-11-08T18:02:37Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/jupyterhub/jupyterhub/security/advisories/GHSA-cw7p-q79f-m2v7"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41247"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jupyterhub/jupyterhub/commit/5ac9e7f73a6e1020ffddc40321fc53336829fe27"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jupyterhub/jupyterhub"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/jupyterhub/PYSEC-2021-386.yaml"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "incomplete JupyterHub logout with simultaneous JupyterLab sessions"
}

GHSA-CWH2-RJ8J-GM58

Vulnerability from github – Published: 2024-11-14 15:32 – Updated: 2024-11-14 15:32

Details

A vulnerability was found in Apereo CAS 6.6 and classified as problematic. Affected by this issue is some unknown functionality of the file /login?service. The manipulation leads to session expiration. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Severity

3.7 (Low)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

6.3 (Medium)


                  
                    CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-11208"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-11-14T14:15:17Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability was found in Apereo CAS 6.6 and classified as problematic. Affected by this issue is some unknown functionality of the file /login?service. The manipulation leads to session expiration. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
  "id": "GHSA-cwh2-rj8j-gm58",
  "modified": "2024-11-14T15:32:16Z",
  "published": "2024-11-14T15:32:16Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11208"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/0xArthurSouza/ce3b89887b03cc899d5e8cb6e472b04e"
    },
    {
      "type": "WEB",
      "url": "https://ibb.co/1LxSK2k"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.284522"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.284522"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?submit.437211"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-CXCR-RJ95-H6F4

Vulnerability from github – Published: 2026-02-17 21:31 – Updated: 2026-02-17 21:31

Details

IBM Security QRadar EDR 3.12 through 3.12.23 does not invalidate session after a session expiration which could allow an authenticated user to impersonate another user on the system.

Severity

6.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-36376"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-02-17T21:22:14Z",
    "severity": "MODERATE"
  },
  "details": "IBM Security QRadar EDR 3.12 through 3.12.23 does not invalidate session after a session expiration which could allow an authenticated user to impersonate another user on the system.",
  "id": "GHSA-cxcr-rj95-h6f4",
  "modified": "2026-02-17T21:31:14Z",
  "published": "2026-02-17T21:31:14Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-36376"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/7260390"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-F24X-5G9Q-753F

Vulnerability from github – Published: 2026-04-14 22:31 – Updated: 2026-04-15 21:06

Summary

OAuth2 Proxy's session cookies are not cleared when rendering sign-in page

Details

Impact

A regression introduced in v7.11.0 is preventing OAuth2 Proxy from clearing the session cookie when rendering the sign-in page.

This only impacts deployments that rely on the sign-in page as part of their logout flow. In those setups, a user may be shown the sign-in page while the existing session cookie remains valid, so the browser session is not actually logged out. On shared workstations be it browsers or devices, a subsequent user could continue to use the previous user's authenticated session.

Deployments that use a dedicated logout/sign-out endpoint to terminate sessions are not affected.

Patches

This issue is fixed in v7.15.2.

Workarounds

Do not rely on the sign-in page to clear an existing session. Instead:

Use the dedicated logout/sign-out endpoint of OAuth2 Proxy
Ensure your application logout flow explicitly clears the OAuth2 Proxy session cookie before redirecting users to the sign-in page
If needed, clear the session cookie at the reverse proxy or application layer as a temporary mitigation

Severity

3.5 (Low)


                  
                    CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/oauth2-proxy/oauth2-proxy/v7"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.11.0"
            },
            {
              "fixed": "7.15.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-34454"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-384",
      "CWE-613"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-14T22:31:03Z",
    "nvd_published_at": "2026-04-14T23:16:28Z",
    "severity": "LOW"
  },
  "details": "### Impact\nA regression introduced in [v7.11.0](https://github.com/oauth2-proxy/oauth2-proxy/pull/2605) is preventing OAuth2 Proxy from clearing the session cookie when rendering the sign-in page.\n\nThis only impacts deployments that rely on the sign-in page as part of their logout flow. In those setups, a user may be shown the sign-in page while the existing session cookie remains valid, so the browser session is not actually logged out. On shared workstations be it browsers or devices, a subsequent  user could continue to use the previous user\u0027s authenticated session.\n\nDeployments that use a dedicated logout/sign-out endpoint to terminate sessions are not affected.\n\n### Patches\nThis issue is fixed in v7.15.2.\n\n### Workarounds\nDo not rely on the sign-in page to clear an existing session. Instead:\n\n- Use the dedicated logout/sign-out endpoint of OAuth2 Proxy\n- Ensure your application logout flow explicitly clears the OAuth2 Proxy   session cookie before redirecting users to the sign-in page\n- If needed, clear the session cookie at the reverse proxy or application   layer as a temporary mitigation",
  "id": "GHSA-f24x-5g9q-753f",
  "modified": "2026-04-15T21:06:34Z",
  "published": "2026-04-14T22:31:03Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-f24x-5g9q-753f"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34454"
    },
    {
      "type": "WEB",
      "url": "https://github.com/oauth2-proxy/oauth2-proxy/pull/2605"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/oauth2-proxy/oauth2-proxy"
    },
    {
      "type": "WEB",
      "url": "https://github.com/oauth2-proxy/oauth2-proxy/releases/tag/v7.15.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "OAuth2 Proxy\u0027s session cookies are not cleared when rendering sign-in page"
}

GHSA-F3Q9-V3P2-WX3Q

Vulnerability from github – Published: 2022-05-24 17:31 – Updated: 2022-05-24 17:31

Details

An issue was discovered in the yh_create_session() function of yubihsm-shell through 2.0.2. The function does not explicitly check the returned session id from the device. An invalid session id would lead to out-of-bounds read and write operations in the session array. This could be used by an attacker to cause a denial of service attack.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2020-24387"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-10-19T20:15:00Z",
    "severity": "HIGH"
  },
  "details": "An issue was discovered in the yh_create_session() function of yubihsm-shell through 2.0.2. The function does not explicitly check the returned session id from the device. An invalid session id would lead to out-of-bounds read and write operations in the session array. This could be used by an attacker to cause a denial of service attack.",
  "id": "GHSA-f3q9-v3p2-wx3q",
  "modified": "2022-05-24T17:31:13Z",
  "published": "2022-05-24T17:31:13Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-24387"
    },
    {
      "type": "WEB",
      "url": "https://blog.inhq.net/posts/yubico-libyubihsm-vuln"
    },
    {
      "type": "WEB",
      "url": "https://developers.yubico.com/yubihsm-shell"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Yubico/yubihsm-shell"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Y77KQJW76M3PFOBFLBT6DLH2NWHYRNZO"
    },
    {
      "type": "WEB",
      "url": "https://www.yubico.com/support/security-advisories/ysa-2020-06"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-F4HC-MPG9-VM8W

Vulnerability from github – Published: 2025-03-26 12:30 – Updated: 2025-08-25 03:33

Details

Session logout could be overwritten in Checkmk GmbH's Checkmk versions <2.3.0p30, <2.2.0p41, and 2.1.0p49 (EOL)

Severity

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

2.3 (Low)


                  
                    CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-2596"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-03-26T11:15:39Z",
    "severity": "LOW"
  },
  "details": "Session logout could be overwritten in Checkmk GmbH\u0027s Checkmk versions \u003c2.3.0p30, \u003c2.2.0p41, and 2.1.0p49 (EOL)",
  "id": "GHSA-f4hc-mpg9-vm8w",
  "modified": "2025-08-25T03:33:06Z",
  "published": "2025-03-26T12:30:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2596"
    },
    {
      "type": "WEB",
      "url": "https://checkmk.com/werk/17808"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-F55R-8RCV-MQCF

Vulnerability from github – Published: 2023-04-28 15:30 – Updated: 2023-11-22 16:31

Summary

Concrete CMS missing secure cookie parameters

Details

Concrete CMS (previously concrete5) before 9.2 does not have Secure and HTTP only attributes set for ccmPoll cookies.

Severity

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "concrete5/concrete5"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "9.2.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-28472"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-04-28T20:40:05Z",
    "nvd_published_at": "2023-04-28T14:15:10Z",
    "severity": "MODERATE"
  },
  "details": "Concrete CMS (previously concrete5) before 9.2 does not have Secure and HTTP only attributes set for ccmPoll cookies.",
  "id": "GHSA-f55r-8rcv-mqcf",
  "modified": "2023-11-22T16:31:00Z",
  "published": "2023-04-28T15:30:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28472"
    },
    {
      "type": "WEB",
      "url": "https://github.com/concretecms/concretecms/pull/11749"
    },
    {
      "type": "WEB",
      "url": "https://concretecms.com"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/concretecms/concretecms"
    },
    {
      "type": "WEB",
      "url": "https://github.com/concretecms/concretecms/releases/tag/8.5.13"
    },
    {
      "type": "WEB",
      "url": "https://www.concretecms.org/about/project-news/security/2023-11-09-security-blog-about-updated-cves-and-new-release"
    },
    {
      "type": "WEB",
      "url": "https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2023-04-20"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Concrete CMS missing secure cookie parameters"
}

CWE-613

Insufficient Session Expiration

GHSA-CQ9C-6W48-QMFG

Summary

Details

PoC

Impact

GHSA-CRF4-J4G9-P5F8

GHSA-CVG9-CJ93-X2H9

GHSA-CW7P-Q79F-M2V7

Impact

Patches

Workarounds

GHSA-CWH2-RJ8J-GM58

GHSA-CXCR-RJ95-H6F4

GHSA-F24X-5G9Q-753F

Impact

Patches

Workarounds

GHSA-F3Q9-V3P2-WX3Q

GHSA-F4HC-MPG9-VM8W

GHSA-F55R-8RCV-MQCF

Mitigation