https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 23:16:48 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-318607 EUVD-2026-318607 https://cve.radiocsirt.org/vuln/euvd-2026-318607 https://cve.radiocsirt.org/vuln/fkie_cve-2026-44511 <p>Katalyst Koi is a framework for building Rails admin functionality. Prior to 4.20.0 and 5.6.0, admin session cookies were not invalidated when an admin user logged out. An attacker with access to a valid admin session cookie could continue to access admin functionality after logout, until the cookie expired or session secrets were rotated. This vulnerability is fixed in 4.20.0 and 5.6.0.</p> <p>Katalyst Koi is a framework for building Rails admin functionality. Prior to 4.20.0 and 5.6.0, admin session cookies were not invalidated when an admin user logged out. An attacker with access to a valid admin session cookie could continue to access admin functionality after logout, until the cookie expired or session secrets were rotated. This vulnerability is fixed in 4.20.0 and 5.6.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-44511 https://cve.radiocsirt.org/vuln/ghsa-4cx3-3c38-j9vv <p><strong>Affected:</strong> RubyGems: katalyst-koi</p> <p>### Impact</p> <p>Admin session cookies were not invalidated when an admin user logged out. An attacker with access to a valid admin session cookie could continue to access admin functionality after logout, until the cookie expired or session secrets were rotated.</p> <p>This affects applications using Koi admin authentication where an admin session cookie may have been exposed, cached, intercepted, or otherwise retained after logout.</p> <p>### Patches</p> <p>The issue has been patched by recording admin logout time and rejecting any admin session cookie created before the user’s most recent logout.</p> <p>Users should upgrade to the patched Koi releases once available.</p> <p>### Workarounds</p> <p>Katalyst Koi recommends upgrading to the latest available version, or back porting the changes released in 5.6.0/4.20.0</p> <p>### Resources</p> <p>This is an application of https://guides.rubyonrails.org/v5.2.0/security.html#replay-attacks-for-cookiestore-sessions</p> <p><strong>Affected:</strong> RubyGems: katalyst-koi</p> <p>### Impact</p> <p>Admin session cookies were not invalidated when an admin user logged out. An attacker with access to a valid admin session cookie could continue to access admin functionality after logout, until the cookie expired or session secrets were rotated.</p> <p>This affects applications using Koi admin authentication where an admin session cookie may have been exposed, cached, intercepted, or otherwise retained after logout.</p> <p>### Patches</p> <p>The issue has been patched by recording admin logout time and rejecting any admin session cookie created before the user’s most recent logout.</p> <p>Users should upgrade to the patched Koi releases once available.</p> <p>### Workarounds</p> <p>Katalyst Koi recommends upgrading to the latest available version, or back porting the changes released in 5.6.0/4.20.0</p> <p>### Resources</p> <p>This is an application of https://guides.rubyonrails.org/v5.2.0/security.html#replay-attacks-for-cookiestore-sessions</p> https://cve.radiocsirt.org/vuln/ghsa-4cx3-3c38-j9vv