Live › vulnerability › CVE-2016-8638
Go to dashboardIpsilon, a Python identity provider, tracks user sessions in a way that lets an unauthenticated attacker view and terminate other users' active sessions. The sources describe this as a SAML2 multi-session flaw tracked as session fixation (CWE-384).
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 17:27 UTC, 0h before NVD. All times on this page are UTC.
Teams that run Ipsilon as their SAML2 or identity provider and have not upgraded past the fixed versions for their branch are exposed. The sources do not describe a specific deployment pattern beyond the affected version ranges, so unknown whether particular configurations are safer. Teams not running Ipsilon can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| ipsilon | pypi | >= 2.0.0, < 2.0.2 | 2.0.2 |
| ipsilon | pypi | >= 1.2.0, < 1.2.1 | 1.2.1 |
| ipsilon | pypi | >= 1.1.0, < 1.1.2 | 1.1.2 |
| ipsilon | pypi | >= 1.0.0, < 1.0.3 | 1.0.3 |
| ipsilon project ipsilon | vendor | = 1.0.0 | – |
| ipsilon project ipsilon | vendor | = 1.0.1 | – |
| ipsilon project ipsilon | vendor | = 1.0.2 | – |
| ipsilon project ipsilon | vendor | = 1.1.0 | – |
| ipsilon project ipsilon | vendor | = 1.1.1 | – |
| ipsilon project ipsilon | vendor | = 1.2.0 | – |
| ipsilon project ipsilon | vendor | = 2.0.0 | – |
| ipsilon project ipsilon | vendor | = 2.0.1 | – |
pip show ipsilon and compare the installed version with the affected ranges: 2.0.0 to before 2.0.2, 1.2.0 to before 1.2.1, 1.1.0 to before 1.1.2, and 1.0.0 to before 1.0.3.2.0.2 if on the 2.0 line, 1.2.1 on the 1.2 line, 1.1.2 on the 1.1 line, or 1.0.3 on the 1.0 line.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability in ipsilon 2.0 before 2.0.2, 1.2 before 1.2.1, 1.1 before 1.1.2, and 1.0 before 1.0.3 was found that allows attacker to log out active sessions of other users. This issue is related to how it tracks sessions, and allows an unauthenticated attacker to view and terminate active sessions from other users. It is also called a "SAML2 multi-session vulnerability."
This page as .md · .json · in your agent: get_signal("CVE-2016-8638")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.