All vulnerabilities
CVE-2016-8638GHSA-376m-3rm2-9jm6PYSEC-2026-360

Session Fixation in ipsilon

n/a ipsilonpipLibraries & packages
Open in ThreatlineRecord JSON
CVSS
9.1Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)2.14%Chance of exploitation activity in the next 30 days, higher than 81% of CVEs. Scored 27 Oct 2026FIRST EPSS
Fixed in2.0.2Also 1.2.1, 1.1.2 and 1 moreGitHub
Published12 Jul 2017Updated 27 Oct 2026CVE List

What fixes it

  • 2.0.2ipsilon, pipGitHub
  • 1.2.1ipsilon, pipGitHub
  • 1.1.2ipsilon, pipGitHub
  • 1.0.3ipsilon, pipGitHub
  • 2.0.2ipsilon, PyPIOSVpip install "ipsilon>=2.0.2"
  • 1.2.1ipsilon, PyPIOSVpip install "ipsilon>=1.2.1"
Show all 8 fixed versions
  • 1.1.2ipsilon, PyPIOSVpip install "ipsilon>=1.1.2"
  • 1.0.3ipsilon, PyPIOSVpip install "ipsilon>=1.0.3"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

A vulnerability in ipsilon 2.0 before 2.0.2, 1.2 before 1.2.1, 1.1 before 1.1.2, and 1.0 before 1.0.3 was found that allows attacker to log out active sessions of other users. This issue is related to how it tracks sessions, and allows an unauthenticated attacker to view and terminate active sessions from other users. It is also called a "SAML2 multi-session vulnerability."

Text from CVE List

Affected versions 10

  • ipsilon, pip>= 2.0.0, < 2.0.2GitHub
  • ipsilon, pip>= 1.2.0, < 1.2.1GitHub
  • ipsilon, pip>= 1.1.0, < 1.1.2GitHub
  • ipsilon, pip>= 1.0.0, < 1.0.3GitHub
  • n/aaffected: n/aCVE List
  • ipsilon, PyPIfrom 2.0.0, fixed in 2.0.2OSV
  • ipsilon, PyPIfrom 1.2.0, fixed in 1.2.1OSV
  • ipsilon, PyPI1.2.0OSV
  • ipsilon, PyPIfrom 1.1.0, fixed in 1.1.2OSV
  • ipsilon, PyPIfrom 1.0.0, fixed in 1.0.3OSV

References 15