PYSEC-2026-1246
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/ckan/PYSEC-2026-1246.yaml
- JSON Data
- https://api.osv.dev/v1/vulns/PYSEC-2026-1246
- Aliases
- Published
- 2026-07-07T16:03:08.876313Z
- Modified
- 2026-07-07T17:47:27.135173282Z
- Severity
-
- 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N CVSS Calculator
- Summary
- CKAN vulnerable to fixed session IDs
- Details
-
Impact
Session ids could be fixed by an attacker if the site is configured with server-side session storage (CKAN uses cookie-based session storage by default). The attacker would need to either set a cookie on the victim's browser or steal the victim's currently valid session. Session identifiers are now regenerated after each login.
Patches
This vulnerability has been fixed in CKAN 2.10.9 and 2.11.4
References
- References
-
- https://github.com/ckan/ckan/security/advisories/GHSA-2hvh-cw5c-8q8q
- https://nvd.nist.gov/vuln/detail/CVE-2025-64100
- https://github.com/ckan/ckan/commit/c2fe437f88be850a6edf7a32470772428819fab5
- https://github.com/ckan/ckan
- https://pypi.org/project/ckan
- https://github.com/advisories/GHSA-2hvh-cw5c-8q8q
Affected packages
PyPI / ckan
Package
- Name
- ckan
- View open source insights on deps.dev
- Purl
- pkg:pypi/ckan