CVE-2025-64100

MEDIUM6.1EPSS 0.04%

CKAN vulnerable to fixed session IDs

Published: 10/29/2025Modified: 10/29/2025

Description

### Impact Session ids could be fixed by an attacker if the site is configured with server-side session storage (CKAN uses cookie-based session storage by default). The attacker would need to either set a cookie on the victim's browser or steal the victim's currently valid session. Session identifiers are now regenerated after each login. ### Patches This vulnerability has been fixed in CKAN 2.10.9 and 2.11.4 ### References [https://en.wikipedia.org/wiki/Session_fixation](https://en.wikipedia.org/wiki/Session_fixation)

Affected packages (1)

PyPI/ckan>= 2.10.0, < 2.10.9

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	MEDIUM6.1	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N

References (4)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2025-64100
PATCHhttps://github.com/ckan/ckan
WEBhttps://github.com/ckan/ckan/commit/c2fe437f88be850a6edf7a32470772428819fab5
WEBhttps://github.com/ckan/ckan/security/advisories/GHSA-2hvh-cw5c-8q8q