zenml Session Fixation vulnerability

2024-04-1600:30:33

Google

osv.dev

zenml

session fixation

vulnerability

jwt tokens

user authentication

invalidation

logout

attacker

bypass

4.5 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

8.7%

JSON

A session fixation vulnerability exists in the zenml-io/zenml application, where JWT tokens used for user authentication are not invalidated upon logout. This flaw allows an attacker to bypass authentication mechanisms by reusing a victim’s JWT token.

CPENameOperatorVersion
zenmleq0.2.0rc1
zenmleq0.3.7
zenmleq0.3.8
zenmleq0.40.1
zenmleq0.5.7
zenmleq0.13.0
zenmleq0.40.2
zenmleq0.23.0
zenmleq0.43.0
zenmleq0.53.1