CERT24GHSA-4hv6-xc92-j86g — Vikunja WebSocket authentication ignores server-side session stateLoading data…
CERT24Threat Observatory
Period

GHSA-4hv6-xc92-j86g — Vikunja WebSocket authentication ignores server-side session state

In Vikunja v2.6.0, the WebSocket endpoint does not resolve the JWT session reference against the server-side session table. As a result, WebSocket connections associated with revoked sessions remain active, and new connections can also be created with the same revoked token.

← Back to intelligence

GHSA-4hv6-xc92-j86g — Vikunja WebSocket authentication ignores server-side session state

In Vikunja v2.6.0, the WebSocket endpoint does not resolve the JWT session reference against the server-side session table. As a result, WebSocket connections associated with revoked sessions remain active, and new connections can also be created with the same revoked token.