Description
A session fixation vulnerability exists in the zenml-io/zenml application, where JWT tokens used for user authentication are not invalidated upon logout. This flaw allows an attacker to bypass authentication mechanisms by reusing a victim's JWT token.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| zenml-io | zenml-io/zenml | unspecified – < 0.56.2 | 0.56.2 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | zenml | < 0.56.2 | 0.56.2 | GHSA-g3r5-72hf-p7p2 |