-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaScriptJavaScriptMiggo AIRoot Cause AnalysisThe vulnerability stems from session persistence across authentication boundaries. The SecureSessionManager.logIn function was vulnerable because it handled user authentication without clearing existing session attributes. The commit diff shows this function was modified to add session cleanup logic (regenerating session/clearing fields) when clearSessionOnLogin is enabled. Before this fix, the absence of session cleanup allowed preservation of the _csrf value between pre-login and authenticated sessions, enabling CSRF token fixation. The direct modification of this function in the security patch confirms its role in the vulnerability.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @fastify/passport | npm | < 1.1.0 | 1.1.0 |
| @fastify/passport | npm | >= 2.0.0, < 2.3.0 | 2.3.0 |
Ongoing coverage of React2Shell