https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 08:02:36 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-213489 EUVD-2026-213489 https://cve.radiocsirt.org/vuln/euvd-2026-213489 https://cve.radiocsirt.org/vuln/fkie_cve-2023-29019 <p>@fastify/passport is a port of passport authentication library for the Fastify ecosystem. Applications using `@fastify/passport` in affected versions for user authentication, in combination with `@fastify/session` as the underlying session management mechanism, are vulnerable to session fixation attacks from network and same-site attackers. fastify applications rely on the `@fastify/passport` library for user authentication. The login and user validation are performed by the `authenticate` function. When executing this function, the `sessionId` is preserved between the pre-login and the authenticated session. Network and same-site attackers can hijack the victim&#39;s session by tossing a valid `sessionId` cookie in the victim&#39;s browser and waiting for the victim to log in on the website. As a solution, newer versions of `@fastify/passport` regenerate `sessionId` upon login, preventing the attacker-controlled pre-session cookie from being upgraded to an authenticated session. Users are advised to upgrade. There are no known workarounds for this vulnerability.</p> <p>@fastify/passport is a port of passport authentication library for the Fastify ecosystem. Applications using `@fastify/passport` in affected versions for user authentication, in combination with `@fastify/session` as the underlying session management mechanism, are vulnerable to session fixation attacks from network and same-site attackers. fastify applications rely on the `@fastify/passport` library for user authentication. The login and user validation are performed by the `authenticate` function. When executing this function, the `sessionId` is preserved between the pre-login and the authenticated session. Network and same-site attackers can hijack the victim&#39;s session by tossing a valid `sessionId` cookie in the victim&#39;s browser and waiting for the victim to log in on the website. As a solution, newer versions of `@fastify/passport` regenerate `sessionId` upon login, preventing the attacker-controlled pre-session cookie from being upgraded to an authenticated session. Users are advised to upgrade. There are no known workarounds for this vulnerability.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-29019 https://cve.radiocsirt.org/vuln/ghsa-4m3m-ppvx-xgw9 <p><strong>Affected:</strong> npm: @fastify/passport</p> <p>Applications using `@fastify/passport` for user authentication, in combination with `@fastify/session` as the underlying session management mechanism, are vulnerable to [session fixation attacks](https://owasp.org/www-community/attacks/Session_fixation) from network and same-site attackers.</p> <p>## Details fastify applications rely on the `@fastify/passport` library for user authentication. The login and user validation are performed by the `authenticate` function. When executing this function, the `sessionId` is preserved between the pre-login and the authenticated session. Network and [same-site attackers](https://canitakeyoursubdomain.name/) can hijack the victim&#39;s session by tossing a valid `sessionId` cookie in the victim&#39;s browser and waiting for the victim to log in on the website.</p> <p>## Fix As a solution, newer versions of `@fastify/passport` regenerate `sessionId` upon login, preventing the attacker-controlled pre-session cookie from being upgraded to an authenticated session.</p> <p>## Credits * Pedro Adão (@pedromigueladao), [Instituto Superior Técnico, University of Lisbon](https://tecnico.ulisboa.pt/) * Marco Squarcina (@lavish), [Security &amp; Privacy Research Unit, TU Wien](https://secpriv.wien/)</p> <p><strong>Affected:</strong> npm: @fastify/passport</p> <p>Applications using `@fastify/passport` for user authentication, in combination with `@fastify/session` as the underlying session management mechanism, are vulnerable to [session fixation attacks](https://owasp.org/www-community/attacks/Session_fixation) from network and same-site attackers.</p> <p>## Details fastify applications rely on the `@fastify/passport` library for user authentication. The login and user validation are performed by the `authenticate` function. When executing this function, the `sessionId` is preserved between the pre-login and the authenticated session. Network and [same-site attackers](https://canitakeyoursubdomain.name/) can hijack the victim&#39;s session by tossing a valid `sessionId` cookie in the victim&#39;s browser and waiting for the victim to log in on the website.</p> <p>## Fix As a solution, newer versions of `@fastify/passport` regenerate `sessionId` upon login, preventing the attacker-controlled pre-session cookie from being upgraded to an authenticated session.</p> <p>## Credits * Pedro Adão (@pedromigueladao), [Instituto Superior Técnico, University of Lisbon](https://tecnico.ulisboa.pt/) * Marco Squarcina (@lavish), [Security &amp; Privacy Research Unit, TU Wien](https://secpriv.wien/)</p> https://cve.radiocsirt.org/vuln/ghsa-4m3m-ppvx-xgw9 https://cve.radiocsirt.org/vuln/gsd-2023-29019 gsd-2023-29019 https://cve.radiocsirt.org/vuln/gsd-2023-29019