{"id":"CVE-2016-8638","kind":"vulnerability","aliases":["CVE-2016-8638","GHSA-376m-3rm2-9jm6"],"related":[],"title":"Session Fixation in ipsilon","description":"A vulnerability in ipsilon 2.0 before 2.0.2, 1.2 before 1.2.1, 1.1 before 1.1.2, and 1.0 before 1.0.3 was found that allows attacker to log out active sessions of other users.  This issue is related to how it tracks sessions, and allows an unauthenticated attacker to view and terminate active sessions from other users. It is also called a \"SAML2 multi-session vulnerability.\"","summary":"Ipsilon, a Python identity provider, tracks user sessions in a way that lets an unauthenticated attacker view and terminate other users' active sessions. The sources describe this as a SAML2 multi-session flaw tracked as session fixation (CWE-384).","severity":"critical","cvss":9.1,"epss":0.02136,"exploited":false,"exploited_at":null,"products":[{"name":"ipsilon","fixed":["2.0.2"],"affected":">= 2.0.0, < 2.0.2","ecosystem":"pypi"},{"name":"ipsilon","fixed":["1.2.1"],"affected":">= 1.2.0, < 1.2.1","ecosystem":"pypi"},{"name":"ipsilon","fixed":["1.1.2"],"affected":">= 1.1.0, < 1.1.2","ecosystem":"pypi"},{"name":"ipsilon","fixed":["1.0.3"],"affected":">= 1.0.0, < 1.0.3","ecosystem":"pypi"},{"name":"ipsilon project ipsilon","fixed":[],"affected":"= 1.0.0","ecosystem":"vendor"},{"name":"ipsilon project ipsilon","fixed":[],"affected":"= 1.0.1","ecosystem":"vendor"},{"name":"ipsilon project ipsilon","fixed":[],"affected":"= 1.0.2","ecosystem":"vendor"},{"name":"ipsilon project ipsilon","fixed":[],"affected":"= 1.1.0","ecosystem":"vendor"},{"name":"ipsilon project ipsilon","fixed":[],"affected":"= 1.1.1","ecosystem":"vendor"},{"name":"ipsilon project ipsilon","fixed":[],"affected":"= 1.2.0","ecosystem":"vendor"},{"name":"ipsilon project ipsilon","fixed":[],"affected":"= 2.0.0","ecosystem":"vendor"},{"name":"ipsilon project ipsilon","fixed":[],"affected":"= 2.0.1","ecosystem":"vendor"}],"ecosystems":["pypi","vendor"],"tags":["cwe-384","identity-provider","ipsilon","package","python","saml2","self-hosted"],"not_affected_if":["not-running-ipsilon"],"how_to_check":"- Run `pip show ipsilon` and compare the installed version with the affected ranges: 2.0.0 to before 2.0.2, 1.2.0 to before 1.2.1, 1.1.0 to before 1.1.2, and 1.0.0 to before 1.0.3.","fix":"- Upgrade ipsilon to `2.0.2` if on the 2.0 line, `1.2.1` on the 1.2 line, `1.1.2` on the 1.1 line, or `1.0.3` on the 1.0 line.","status":"open","published_at":"2017-07-12T13:29:00+00:00","first_seen_at":"2026-10-27T17:27:29+00:00","triaged_at":"2026-10-27T17:27:57+00:00","updated_at":"2026-10-27T17:32:47+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-27T17:27:57Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade ipsilon to `2.0.2` if on the 2.0 line, `1.2.1` on the 1.2 line, `1.1.2` on the 1.1 line, or `1.0.3` on the 1.0 line.","reach":"network","title":"Ipsilon: session fixation lets attackers log out other users","impact":"medium","summary":"Ipsilon, a Python identity provider, tracks user sessions in a way that lets an unauthenticated attacker view and terminate other users' active sessions. The sources describe this as a SAML2 multi-session flaw tracked as session fixation (CWE-384).","category":"package","nicknames":[],"who_cares":["ipsilon","saml2","identity-provider","python","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Unauthenticated attacker terminates other users' active login sessions","analyst_note":"","how_to_check":"- Run `pip show ipsilon` and compare the installed version with the affected ranges: 2.0.0 to before 2.0.2, 1.2.0 to before 1.2.1, 1.1.0 to before 1.1.2, and 1.0.0 to before 1.0.3.","needs_analyst":false,"not_affected_if":["not-running-ipsilon"],"who_is_affected":"Teams that run Ipsilon as their SAML2 or identity provider and have not upgraded past the fixed versions for their branch are exposed. The sources do not describe a specific deployment pattern beyond the affected version ranges, so unknown whether particular configurations are safer. Teams not running Ipsilon can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00065,"input_tokens":3520,"output_tokens":595,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2016':6A,14A '-384':45B,95B '-8638':7A,15A '1.0':110C '1.0.3':112C '1.1':106C '1.1.2':108C '1.2':103C '1.2.1':105C '2.0':100C '2.0.2':102C '376m':10A '3rm2':11A '9jm6':12A 'activ':77B,121C,144C 'allow':116C,136C 'also':151C 'attack':71B,117C,139C 'call':152C 'cve':5A,13A 'cwe':44B,94B 'describ':81B 'fixat':2A,93B 'flaw':89B 'found':114C 'ghsa':9A 'ghsa-376m-3rm2-9jm6':8A 'host':55B 'ident':47B,59B 'identity-provid':46B 'ipsilon':4A,16A,17A,18A,19A,20A,22A,23A,25A,26A,28A,29A,31A,32A,34A,35A,37A,38A,40A,41A,43A,49B,56B,99C 'issu':127C 'let':68B 'log':119C 'multi':87B,156C 'multi-sess':86B,155C 'packag':50B 'project':21A,24A,27A,30A,33A,36A,39A,42A 'provid':48B,60B 'python':51B,58B 'relat':129C 'saml2':52B,85B,154C 'self':54B 'self-host':53B 'session':1A,63B,78B,88B,92B,122C,134C,145C,157C 'sourc':80B 'termin':74B,143C 'track':61B,90B,133C 'unauthent':70B,138C 'user':62B,76B,125C,148C 'view':72B,141C 'vulner':97C,158C 'way':66B","nicknames":[],"mitigations":[],"who_affected":"Teams that run Ipsilon as their SAML2 or identity provider and have not upgraded past the fixed versions for their branch are exposed. The sources do not describe a specific deployment pattern beyond the affected version ranges, so unknown whether particular configurations are safer. Teams not running Ipsilon can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2017-07-12T13:29:00+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-376m-3rm2-9jm6","url":"https://github.com/advisories/GHSA-376m-3rm2-9jm6","severity":"critical","published_at":"2022-05-14T03:55:23+00:00","modified_at":"2026-10-27T17:26:46+00:00","first_seen_at":"2026-10-27T17:27:29+00:00","fetched_at":"2026-10-27T17:27:29+00:00","note":null},{"source":"nvd","external_id":"CVE-2016-8638","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-8638","severity":null,"published_at":"2017-07-12T13:29:00+00:00","modified_at":"2026-06-17T00:54:39+00:00","first_seen_at":"2026-10-27T17:32:47+00:00","fetched_at":"2026-10-27T17:32:47+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}