CVE-2026-117549
Description
A flaw was found in @fastify/secure-session. When configured to use signed cookies, the component fails to reject cookies that fail signature validation, proceeding to decrypt and accept the session payload. A remote user holding an unexpired session cookie can exploit this issue to bypass session revocation and maintain unauthorized access when an application rotates only its signing secret.
Statement
This vulnerability is rated as Moderate impact because exploitation requires an attacker to already hold an unexpired session cookie and is restricted to architectures where session revocation depends solely on rotating the cookie signing secret. Unauthorized actors cannot forge session payloads or extend session lifetimes because cryptographic integrity checks on the payload itself remain enforced by the encryption key. In Red Hat environments, exposure is limited to deployments using distinct signing and encryption keys where partial secret rollover is practiced.
Understanding the Weakness (CWE)
Access Control,Integrity,Confidentiality
Technical Impact: Gain Privileges or Assume Identity; Modify Application Data; Execute Unauthorized Code or Commands
An attacker could gain access to sensitive data and possibly execute unauthorized code.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
