CVE-2022-25896 Session Fixation
Attackers can hijack user sessions in the Passport authentication library due to improper session regeneration during login and logout events.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-25896?
CVE-2022-25896 is a medium-severity vulnerability in passport, published on 1 Jul 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
This affects the package passport before 0.6.0. When a user logs in or logs out, the session is regenerated instead of being closed.
Weakness: CWE-384
Which versions are affected by CVE-2022-25896?
2 open source packages ship an affected version, including passport. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
passport npm | All versions | 0.6.0 |
passport npm | All versions | 0.6.0 |
Products include Passport Project Passport.
How do I fix CVE-2022-25896?
Upgrade passport to 0.6.0 or later.
Is CVE-2022-25896 being exploited?
There is no known exploitation of CVE-2022-25896 in the wild and no public exploit code.
Sources
Also known as CLSA-2026-1774830278, DEBIAN-CVE-2022-25896, GHSA-v923-w3x8-wh69, ROOT-APP-NPM-CVE-2022-25896, SNYK-JS-PASSPORT-2840631, UBUNTU-CVE-2022-25896.