GitHub Advisoryadvisory · npm

GHSA-v923-w3x8-wh69 Passport vulnerable to session regeneration when a users logs in or out

MEDIUM Published 2022-07-02 Modified 2023-09-11 Official page ↗

Aliases: CVE-2022-25896
Ecosystem: npm
Packages: passport
Severity: Moderate
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
Weaknesses: CWE-384
Reviewed: 2022-07-06

Affected packages

• npm passport: < 0.6.0 → fixed in 0.6.0

Description

This affects the package passport before 0.6.0. When a user logs in or logs out, the session is regenerated instead of being closed.

Related

Alias · CVE (1)

CVE-2022-25896 This affects the package passport before 0.6.0. vulnerability

Weakness · CWE (1)

CWE-384 Session Fixation weakness

References