CVE-2016-8638Critical· 9.1▾ MidnightSession Fixation in ipsilon
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 50.1 · likelihood 0.4 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 27.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
2.1%
A vulnerability in ipsilon 2.0 before 2.0.2, 1.2 before 1.2.1, 1.1 before 1.1.2, and 1.0 before 1.0.3 was found that allows attacker to log out active sessions of other users. This issue is related to how it tracks sessions, and allows an unauthenticated attacker to view and terminate active sessions from other users. It is also called a "SAML2 multi-session vulnerability."
ipsilon >= 2.0.0, < 2.0.2ipsilon >= 1.2.0, < 1.2.1ipsilon >= 1.1.0, < 1.1.2ipsilon >= 1.0.0, < 1.0.3Upgrade to a patched release:
ipsilon 2.0.2ipsilon 1.2.1ipsilon 1.1.2ipsilon 1.0.3Connected by shared product, vendor, weakness, or advisory.
CVE-2026-57179Medium· 4.2Python Social Auth is a social authentication/registration mechanism
CVE-2026-82355Medium· 4.2When a request to the Airflow core API carries both a session cookie and an explicit `Authorization: Bearer` token, Airflow resolves the caller from the cookie and ignores the bearer token, inverting the intended precedence of bearer ove…
CVE-2026-61592High· 7.4djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance
CVE-2024-23679Critical· 9.8Enonic XP versions less than 7.7.4 are vulnerable to a session fixation issue
CVE-2026-48545Medium· 6.8Gradio before version 6.15.0 contains a cookie injection vulnerability that allows remote attackers to perform cross-Space session fixation by exploiting a shared module-level HTTP client used across all users in the reverse proxy endpoi…
CVE-2026-115910Medium· 6.8Python Social Auth: OpenID Connect nonce is not bound to the browser session, so a stolen authorization code logs the attacker in as the victim