---
id: "CVE-2016-8638"
kind: "vulnerability"
aliases: ["CVE-2016-8638", "GHSA-376m-3rm2-9jm6"]
title: "Session Fixation in ipsilon"
severity: "critical"
cvss: 9.1
epss: 0.02136
exploited: false
status: "open"
category: "package"
products: [{"name": "ipsilon", "fixed": ["2.0.2"], "affected": ">= 2.0.0, < 2.0.2", "ecosystem": "pypi"}, {"name": "ipsilon", "fixed": ["1.2.1"], "affected": ">= 1.2.0, < 1.2.1", "ecosystem": "pypi"}, {"name": "ipsilon", "fixed": ["1.1.2"], "affected": ">= 1.1.0, < 1.1.2", "ecosystem": "pypi"}, {"name": "ipsilon", "fixed": ["1.0.3"], "affected": ">= 1.0.0, < 1.0.3", "ecosystem": "pypi"}, {"name": "ipsilon project ipsilon", "fixed": [], "affected": "= 1.0.0", "ecosystem": "vendor"}, {"name": "ipsilon project ipsilon", "fixed": [], "affected": "= 1.0.1", "ecosystem": "vendor"}, {"name": "ipsilon project ipsilon", "fixed": [], "affected": "= 1.0.2", "ecosystem": "vendor"}, {"name": "ipsilon project ipsilon", "fixed": [], "affected": "= 1.1.0", "ecosystem": "vendor"}, {"name": "ipsilon project ipsilon", "fixed": [], "affected": "= 1.1.1", "ecosystem": "vendor"}, {"name": "ipsilon project ipsilon", "fixed": [], "affected": "= 1.2.0", "ecosystem": "vendor"}, {"name": "ipsilon project ipsilon", "fixed": [], "affected": "= 2.0.0", "ecosystem": "vendor"}, {"name": "ipsilon project ipsilon", "fixed": [], "affected": "= 2.0.1", "ecosystem": "vendor"}]
ecosystems: ["pypi", "vendor"]
tags: ["cwe-384", "identity-provider", "ipsilon", "package", "python", "saml2", "self-hosted"]
not_affected_if: ["not-running-ipsilon"]
published_at: "2017-07-12T13:29:00+00:00"
first_seen_at: "2026-10-27T17:27:29+00:00"
updated_at: "2026-10-27T17:32:47+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-376m-3rm2-9jm6", "first_seen_at": "2026-10-27T17:27:29+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-8638", "first_seen_at": "2026-10-27T17:32:47+00:00"}]
---

# Session Fixation in ipsilon

Ipsilon, a Python identity provider, tracks user sessions in a way that lets an unauthenticated attacker view and terminate other users' active sessions. The sources describe this as a SAML2 multi-session flaw tracked as session fixation (CWE-384).

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:ipsilon affected >= 2.0.0, < 2.0.2 fixed 2.0.2
- pypi:ipsilon affected >= 1.2.0, < 1.2.1 fixed 1.2.1
- pypi:ipsilon affected >= 1.1.0, < 1.1.2 fixed 1.1.2
- pypi:ipsilon affected >= 1.0.0, < 1.0.3 fixed 1.0.3
- vendor:ipsilon project ipsilon affected = 1.0.0 fixed ?
- vendor:ipsilon project ipsilon affected = 1.0.1 fixed ?
- vendor:ipsilon project ipsilon affected = 1.0.2 fixed ?
- vendor:ipsilon project ipsilon affected = 1.1.0 fixed ?
- vendor:ipsilon project ipsilon affected = 1.1.1 fixed ?
- vendor:ipsilon project ipsilon affected = 1.2.0 fixed ?
- vendor:ipsilon project ipsilon affected = 2.0.0 fixed ?
- vendor:ipsilon project ipsilon affected = 2.0.1 fixed ?

## How to check

- Run `pip show ipsilon` and compare the installed version with the affected ranges: 2.0.0 to before 2.0.2, 1.2.0 to before 1.2.1, 1.1.0 to before 1.1.2, and 1.0.0 to before 1.0.3.

## Fix

- Upgrade ipsilon to `2.0.2` if on the 2.0 line, `1.2.1` on the 1.2 line, `1.1.2` on the 1.1 line, or `1.0.3` on the 1.0 line.

## Timeline

- 2026-10-27T17:27:29+00:00 ghsa https://github.com/advisories/GHSA-376m-3rm2-9jm6
- 2026-10-27T17:32:47+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2016-8638

## From the sources

A vulnerability in ipsilon 2.0 before 2.0.2, 1.2 before 1.2.1, 1.1 before 1.1.2, and 1.0 before 1.0.3 was found that allows attacker to log out active sessions of other users.  This issue is related to how it tracks sessions, and allows an unauthenticated attacker to view and terminate active sessions from other users. It is also called a "SAML2 multi-session vulnerability."

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_