-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaScriptJavaScriptMiggo AIRoot Cause AnalysisThe vulnerability stems from the server's failure to terminate existing socket connections when enabling authentication. The patch adds a critical check in server/server.js (lines 1205-1212) that calls disconnectAllSocketClients() when auth is enabled. This indicates the vulnerable code path was the settings update handler that previously didn't include this session invalidation. The CWE-384 classification confirms this is a session fixation issue where existing sessions remained valid after a security-critical state change.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| uptime-kuma | npm | <= 1.23.11 | 1.23.12 |
Ongoing coverage of React2Shell