Session Fixation

passport is vulnerable to session fixation. A remote unauthenticated attacker is able to gain access to guest sessions because when a user logs in or logs out, the session is regenerated instead of being closed...

1batch (=1.0.0), 30-lines-telegram-bot (>=1.0.0 <=1.0.1) +4707 more potentially affected by CVE-2022-25896 via passport (>=0.1.10 <=0.5.3)

passport NPM version =0.1.10, =1.0.0, =1.1.0, =4.11.0, =0.1.0, =0.0.1, =1.0.3, =1.0.0, =1.0.0, =1.0.0, =0.0.1, =1.1.18 and more Source cves: CVE-2022-25896 Source advisory: OSV:GHSA-V923-W3X8-WH69...

CVE-2022-25896

This affects the package passport before 0.6.0. When a user logs in or logs out, the session is regenerated instead of being closed...

1batch (=1.0.0), 30-lines-telegram-bot (>=1.0.0 <=1.0.1) +4707 more potentially affected by CVE-2022-25896 via passport (>=0.1.10 <=0.5.3)

passport NPM version =0.1.10, =1.0.0, =1.1.0, =4.11.0, =0.1.0, =0.0.1, =1.0.3, =1.0.0, =1.0.0, =1.0.0, =0.0.1, =1.1.18 and more Source cves: CVE-2022-25896 Source advisory: SNYK:JS-PASSPORT-2840631...