CVE-2025-64100: CKAN vulnerable to fixed session IDs

October 29, 2025

Session ids could be fixed by an attacker if the site is configured with server-side session storage (CKAN uses cookie-based session storage by default). The attacker would need to either set a cookie on the victim’s browser or steal the victim’s currently valid session. Session identifiers are now regenerated after each login.

References

github.com/advisories/GHSA-2hvh-cw5c-8q8q
github.com/ckan/ckan
github.com/ckan/ckan/commit/c2fe437f88be850a6edf7a32470772428819fab5
github.com/ckan/ckan/security/advisories/GHSA-2hvh-cw5c-8q8q
nvd.nist.gov/vuln/detail/CVE-2025-64100

Code Behaviors & Features

Detect and mitigate CVE-2025-64100 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →