---
id: CVE-2016-8638
aliases:
  - GHSA-376m-3rm2-9jm6
  - PYSEC-2026-360
title: Session Fixation in ipsilon
summary: Session Fixation in ipsilon
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H'
vendor: ipsilon
product: ipsilon
ecosystem: pip
affected:
  - 'ipsilon >= 2.0.0, < 2.0.2'
  - 'ipsilon >= 1.2.0, < 1.2.1'
  - 'ipsilon >= 1.1.0, < 1.1.2'
  - 'ipsilon >= 1.0.0, < 1.0.3'
patched:
  - ipsilon 2.0.2
  - ipsilon 1.2.1
  - ipsilon 1.1.2
  - ipsilon 1.0.3
published: '2022-05-14'
updated: '2026-10-27'
sourceUpdated: '2026-10-27T17:45:04.012363817Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-376m-3rm2-9jm6'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2016-8638'
  - url: >-
      https://github.com/ipsilon-project/ipsilon/commit/1c48414877fc110652b6078a29529972c7ec9122
  - url: >-
      https://github.com/ipsilon-project/ipsilon/commit/64fc366c054fc6af1d9d2692902db169884b5f78
  - url: >-
      https://github.com/ipsilon-project/ipsilon/commit/a33303b6beb5c316d7c18b23566b7666a4e307a4
  - url: >-
      https://github.com/ipsilon-project/ipsilon/commit/b4744a92d4fa7f6d7ade0ae2d99a2dc0ea94734d
  - url: 'https://access.redhat.com/errata/RHSA-2016:2809'
  - url: 'https://access.redhat.com/security/cve/CVE-2016-8638'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=1392829'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8638'
  - url: 'https://github.com/advisories/GHSA-376m-3rm2-9jm6'
  - url: 'https://github.com/ipsilon-project/ipsilon'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/ipsilon/PYSEC-2026-360.yaml
  - url: 'https://ipsilon-project.org/advisory/CVE-2016-8638.txt'
  - url: 'https://ipsilon-project.org/release/2.1.0.html'
  - url: 'https://pagure.io/ipsilon/c/511fa8b7001c2f9a42301aa1d4b85aaf170a461c'
  - url: 'https://pypi.org/project/ipsilon'
  - url: 'http://rhn.redhat.com/errata/RHSA-2016-2809.html'
  - url: 'http://www.securityfocus.com/bid/94439'
tags:
  - osv
  - pip
  - ghsa
epss: 0.02136
epssPercentile: 0.81917
cwe:
  - CWE-384
ingestedAt: '2026-10-27T17:33:23.768Z'
---

## Overview

A vulnerability in ipsilon 2.0 before 2.0.2, 1.2 before 1.2.1, 1.1 before 1.1.2, and 1.0 before 1.0.3 was found that allows attacker to log out active sessions of other users.  This issue is related to how it tracks sessions, and allows an unauthenticated attacker to view and terminate active sessions from other users. It is also called a "SAML2 multi-session vulnerability."

## Affected packages

- `ipsilon >= 2.0.0, < 2.0.2`
- `ipsilon >= 1.2.0, < 1.2.1`
- `ipsilon >= 1.1.0, < 1.1.2`
- `ipsilon >= 1.0.0, < 1.0.3`

## Remediation

Upgrade to a patched release:

- `ipsilon 2.0.2`
- `ipsilon 1.2.1`
- `ipsilon 1.1.2`
- `ipsilon 1.0.3`