CRITICALCVSS 9.1EPSS 2.1%

CVE-2016-8638

Session Fixation in ipsilon

Published: 2022-05-14
Modified: 2026-10-27
EPSS percentile: 82%
Aliases: GHSA-376m-3rm2-9jm6
Sources: github-advisory

Summary

A vulnerability in ipsilon 2.0 before 2.0.2, 1.2 before 1.2.1, 1.1 before 1.1.2, and 1.0 before 1.0.3 was found that allows attacker to log out active sessions of other users. This issue is related to how it tracks sessions, and allows an unauthenticated attacker to view and terminate active sessions from other users. It is also called a "SAML2 multi-session vulnerability."

Affected packages

Ecosystem	Package	Affected versions	Fixed versions
PyPI	ipsilon	—	2.0.2, 1.2.1, 1.1.2, 1.0.3

Remediation: Upgrade to 2.0.2 or later.

References

https://github.com/advisories/GHSA-376m-3rm2-9jm6

Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.

EPSS scores provided by the FIRST.org Exploit Prediction Scoring System.