# Session validation flaw

Session validation flaw
Medium · Patch available
Affected: Example Auth 3.1
Fixed in: 3.1.4

Expired session cookies are accepted when the clock skew header is omitted.

What to do:
- Upgrade Example Auth to 3.1.4.
- Expire sessions issued before the upgrade.

Sources:
- Auth advisory https://example.com/session-flaw

Canonical page: https://www.incidentping.com/incidents/session-validation-flaw