← Back to CVE Explorer

CVE-2026-123317

Full vulnerability record from the local CVENow database.

Description

In JetBrains Ktor before 3.6.1 session forgery was possible via tampered encrypted session cookies

Severity

HIGH

CVSS score

8.1 (v3.1)

Vulnerability status

Received

Source identifier

[email protected]

Published

2026-11-06 11:17:11.170000

Last modified

2026-11-06 11:17:11.170000

View original CVE JSON

{
  "id": "CVE-2026-123317",
  "sourceIdentifier": "[email protected]",
  "published": "2026-11-06T11:17:11.170",
  "lastModified": "2026-11-06T11:17:11.170",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In JetBrains Ktor before 3.6.1 session forgery was possible via tampered encrypted session cookies"
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "JetBrains",
          "product": "Ktor",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThan": "3.6.1",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.2
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-354"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.jetbrains.com/privacy-security/issues-fixed/",
      "source": "[email protected]"
    }
  ]
}