{"items":[{"id":"NVI-00020093","kind":"vulnerability","title":"Hydro: Insufficient session expiration when recreating sessions","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-94jp-7776-qj6q","CVE-2026-55617"],"plain_summary":"GitHub lists this reviewed advisory for hydrooj. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-74f81c6b629b5ca7d51c7bd9a39555b9"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-74f81c6b629b5ca7d51c7bd9a39555b9","url":"https://github.com/advisories/GHSA-94jp-7776-qj6q","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-94jp-7776-qj6q","publisher":"GitHub Advisory Database","observed_at":"2026-11-06T07:20:20.042Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-74f81c6b629b5ca7d51c7bd9a39555b9"],"technology":"hydrooj","known_exclusions":[],"conditions_summary":"### Impact\n\nHydro contains an insufficient session expiration vulnerability in its session recreation logic. When a session is recreated, including during logout or other session renewal flows, Hydro creates a new session token but does not delete the previous server-side session token.\n\nAs a result, an old sid cookie may remain valid even after the legitimate user logs out or the session is recreated. An attacker who has obtained a victim's previous sid cookie can replay that cookie over HTTP or HTTPS and continue to access the affected Hydro instance as the victim.\n\nThe attacker does not need the victim's username or password. Exploitation requires possession of a previously valid stale sid cookie, but no user interaction is required at exploitation time.\n\nSuccessful exploitation may allow account takeover within the affected Hydro instance. For a normal user account, this may allow disclosure of private data and unauthorized modification or deletion of data available to the victim.\n\n### Patches\n\nThe issue has been patched by deleting the old server-side session token before creating a new one during session recreation.\n\nPatched in:\n\n- Pull request: https://github.com/hydro-dev/H","public_affected_ranges":[">= 4.10.4, <= 5.0.1"]}],"null_published_at":"2026-11-08T15:11:49.348Z","source_updated_at":"2026-06-18T13:06:35.000Z","source_disclosed_at":"2026-06-18T13:06:35.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-06T07:20:20.042Z"}],"next_cursor":null,"snapshot_revision":"42594"}