https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 21:24:12 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-186561 EUVD-2026-186561 https://cve.radiocsirt.org/vuln/euvd-2026-186561 https://cve.radiocsirt.org/vuln/fkie_cve-2023-44400 <p>Uptime Kuma is a self-hosted monitoring tool. Prior to version 1.23.3, attackers with access to a user&#39;s device can gain persistent account access. This is caused by missing verification of Session Tokens after password changes and/or elapsed inactivity periods. Version 1.23.3 has a patch for the issue.</p> <p>Uptime Kuma is a self-hosted monitoring tool. Prior to version 1.23.3, attackers with access to a user&#39;s device can gain persistent account access. This is caused by missing verification of Session Tokens after password changes and/or elapsed inactivity periods. Version 1.23.3 has a patch for the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-44400 https://cve.radiocsirt.org/vuln/ghsa-g9v2-wqcj-j99g <p><strong>Affected:</strong> npm: uptime-kuma</p> <p># Summary</p> <p>Attackers with access to a users&#39; device can gain persistent account access. This is caused by missing verification of Session Tokens after password changes and/or elapsed inactivity-periods.</p> <p># Details</p> <p>`uptime-kuma` sets JWT tokens for users after successful authentication.</p> <p>These tokens have the following design flaws: - After successful login, a JWT token and it is stored in `sessionStorage` or `localStorage`. Which of the two is decided based on the `Remember Me` button. The users&#39; token is valid without any time limitation, even after long periods of inactivity. This increases the risk of session hijacking if, for example, a user forgets to log off and leaves the PC. - sessions are only deleted on the client side after a user loggs out, meaning a local attacker could reuse said token with deep system access over the browser - If a user changes a password - any previously logged in clients are not logged out - previously issued tokens remained valid forever</p> <p>These flaws allow user cookies to remain valid even after changing passwords or being inactive, posing a high security risk.</p> <p># POC ### Password resets not deactivating cookies - Log in. - Note the user cookie. - Change your password. - Attempt to log in again with the same cookie. - The cookie remains valid despite the password change.</p> <p>### Inactivity not deactivating sessions In testing, even after a period of over a day of inactivity, the session was still valid</p> <p># Impact</p> <p>Another person…</p> <p><strong>Affected:</strong> npm: uptime-kuma</p> <p># Summary</p> <p>Attackers with access to a users&#39; device can gain persistent account access. This is caused by missing verification of Session Tokens after password changes and/or elapsed inactivity-periods.</p> <p># Details</p> <p>`uptime-kuma` sets JWT tokens for users after successful authentication.</p> <p>These tokens have the following design flaws: - After successful login, a JWT token and it is stored in `sessionStorage` or `localStorage`. Which of the two is decided based on the `Remember Me` button. The users&#39; token is valid without any time limitation, even after long periods of inactivity. This increases the risk of session hijacking if, for example, a user forgets to log off and leaves the PC. - sessions are only deleted on the client side after a user loggs out, meaning a local attacker could reuse said token with deep system access over the browser - If a user changes a password - any previously logged in clients are not logged out - previously issued tokens remained valid forever</p> <p>These flaws allow user cookies to remain valid even after changing passwords or being inactive, posing a high security risk.</p> <p># POC ### Password resets not deactivating cookies - Log in. - Note the user cookie. - Change your password. - Attempt to log in again with the same cookie. - The cookie remains valid despite the password change.</p> <p>### Inactivity not deactivating sessions In testing, even after a period of over a day of inactivity, the session was still valid</p> <p># Impact</p> <p>Another person…</p> https://cve.radiocsirt.org/vuln/ghsa-g9v2-wqcj-j99g https://cve.radiocsirt.org/vuln/gsd-2023-44400 gsd-2023-44400 https://cve.radiocsirt.org/vuln/gsd-2023-44400