Session validation flaw
Medium
Example incident
- Status
- Patch available
- Affected
- Example Auth 3.1
- Fixed in
- 3.1.4
Summary
Expired session cookies are accepted when the clock skew header is omitted.
Updates
-
6h ago
Patch released
Incident brief
Session validation flaw
Medium · Patch available
Affected: Example Auth 3.1
Fixed in: 3.1.4
Expired session cookies are accepted when the clock skew header is omitted.
What to do:
- Upgrade Example Auth to 3.1.4.
- Expire sessions issued before the upgrade.
Sources:
- Auth advisory https://example.com/session-flaw