CVE-2026-44511 Katalyst Koi: Session cookies can be replayed after user logout
Attackers can reuse admin session cookies after logout to maintain unauthorized access to administrative functions in Katalyst Koi.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-44511?
CVE-2026-44511 is a high-severity authentication bypass vulnerability in katalyst koi, published on 14 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Katalyst Koi is a framework for building Rails admin functionality. Prior to 4.20.0 and 5.6.0, admin session cookies were not invalidated when an admin user logged out. An attacker with access to a valid admin session cookie could continue to access admin functionality after logout, until the cookie expired or session secrets were rotated. This vulnerability is fixed in 4.20.0 and 5.6.0.
Weakness: CWE-613
Which versions are affected by CVE-2026-44511?
4 open source packages ship an affected version, including katalyst-koi.
| Package | Affected | Fixed in |
|---|---|---|
katalyst-koi RubyGems | All versions | 4.20.0 |
katalyst-koi RubyGems | All versions | 4.20.0 |
katalyst-koi RubyGems | From 5.0.0 | 5.6.0 |
katalyst-koi RubyGems | From 5.0.0 | 5.6.0 |
How do I fix CVE-2026-44511?
Upgrade katalyst-koi to a fixed version for your release line: 4.20.0 or 5.6.0.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-44511 being exploited?
There is no known exploitation of CVE-2026-44511 in the wild and no public exploit code.
Sources
Also known as GHSA-4cx3-3c38-j9vv.