CVE-2026-123317 · Package
NO FIX YET · SEE WHAT TO DO
Ktor versions before 3.6.1 accept tampered encrypted session cookies, so an attacker can forge a session. A forged session can act as another user, depending on what the application stores in its sessions.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Applications built with Ktor before 3.6.1 that use the sessions feature with encrypted session cookies are exposed. Applications that do not use server-side sessions with cookies, or that run only a patched version, can skip it.
Not affected if no-session-cookies, version-3.6.1-or-later
Who cares jvm, kotlin, ktor, session-cookies
ktor in gradle/libs.versions.toml or build.gradle.kts); versions below 3.6.1 are affected.sessions { cookie(...) } with an encryption transform).3.6.1 or laterIn JetBrains Ktor before 3.6.1 session forgery was possible via tampered encrypted session cookies
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.