CVE-2025-64100

Published: Oct 29, 2025Modified: Jun 17, 2026Deferred

6.1

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N

Exploitability: 1.6 / Impact: 4.0

Source: security-advisories@github.com (Secondary)

Description

CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.9 and 2.11.4, session ids could be fixed by an attacker if the site is configured with server-side session storage (CKAN uses cookie-based session storage by default). The attacker would need to either set a cookie on the victim's browser or steal the victim's currently valid session. Session identifiers are now regenerated after each login. This vulnerability has been fixed in CKAN 2.10.9 and 2.11.4

Related CWEs

CWE-384

Session Fixation

Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

References (2)

https://github.com/ckan/ckan/commit/c2fe437f88be850a6edf7a32470772428819fab5

Source: security-advisories@github.com

https://github.com/ckan/ckan/security/advisories/GHSA-2hvh-cw5c-8q8q

Source: security-advisories@github.com

Timeline

No history available yet.