{"id":"CVE-2026-123317","kind":"vulnerability","aliases":["CVE-2026-123317"],"related":[],"title":"Ktor: tampered encrypted session cookies let attackers forge sessions","description":"In JetBrains Ktor before 3.6.1 session forgery was possible via tampered encrypted session cookies","summary":"Ktor versions before 3.6.1 accept tampered encrypted session cookies, so an attacker can forge a session. A forged session can act as another user, depending on what the application stores in its sessions.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["jvm","kotlin","ktor","package","session-cookies"],"not_affected_if":["no-session-cookies","version-3.6.1-or-later"],"how_to_check":"- Check the Ktor version in the project's build file (for example `ktor` in `gradle/libs.versions.toml` or `build.gradle.kts`); versions below `3.6.1` are affected.\n- Check whether the application uses Ktor's session feature with encrypted cookies (`sessions { cookie(...) }` with an encryption transform).","fix":"- Ktor: upgrade to `3.6.1` or later","status":"open","published_at":"2026-11-06T11:17:11+00:00","first_seen_at":"2026-11-06T11:41:26+00:00","triaged_at":"2026-11-06T11:41:54+00:00","updated_at":"2026-11-06T11:41:54+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-06T11:41:54Z","model":"claude-haiku-5-5","output":{"fix":"- Ktor: upgrade to `3.6.1` or later","reach":"internet","title":"Ktor: tampered encrypted session cookies let attackers forge sessions","impact":"high","summary":"Ktor versions before 3.6.1 accept tampered encrypted session cookies, so an attacker can forge a session. A forged session can act as another user, depending on what the application stores in its sessions.","audience":"developers","category":"package","nicknames":[],"who_cares":["ktor","kotlin","jvm","session-cookies"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"attacker forges a session and acts as another user","analyst_note":"","how_to_check":"- Check the Ktor version in the project's build file (for example `ktor` in `gradle/libs.versions.toml` or `build.gradle.kts`); versions below `3.6.1` are affected.\n- Check whether the application uses Ktor's session feature with encrypted cookies (`sessions { cookie(...) }` with an encryption transform).","plain_action":"","needs_analyst":false,"not_affected_if":["version-3.6.1-or-later","no-session-cookies"],"who_is_affected":"Applications built with Ktor before 3.6.1 that use the sessions feature with encrypted session cookies are exposed. Applications that do not use server-side sessions with cookies, or that run only a patched version, can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000677,"input_tokens":4161,"output_tokens":521,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123317':12A,15A '-2026':11A,14A '3.6.1':26B,60C 'accept':27B 'act':43B 'anoth':45B 'applic':51B 'attack':7A,34B 'cooki':5A,22B,31B,69C 'cve':10A,13A 'depend':47B 'encrypt':3A,29B,67C 'forg':8A,36B,40B 'forgeri':62C 'jetbrain':57C 'jvm':16B 'kotlin':17B 'ktor':1A,18B,23B,58C 'let':6A 'packag':19B 'possibl':64C 'session':4A,9A,21B,30B,38B,41B,55B,61C,68C 'session-cooki':20B 'store':52B 'tamper':2A,28B,66C 'user':46B 'version':24B 'via':65C","nicknames":[],"mitigations":[],"who_affected":"Applications built with Ktor before 3.6.1 that use the sessions feature with encrypted session cookies are exposed. Applications that do not use server-side sessions with cookies, or that run only a patched version, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","jvm","kotlin","ktor","package","sessioncookies"],"campaign_type":null,"search_a":"'-123317':12A,15A '-2026':11A,14A 'attack':7A 'cooki':5A 'cve':10A,13A 'encrypt':3A 'forg':8A 'ktor':1A 'let':6A 'session':4A,9A 'tamper':2A","search_b":"'3.6.1':26B 'accept':27B 'act':43B 'anoth':45B 'applic':51B 'attack':34B 'cooki':22B,31B 'depend':47B 'encrypt':29B 'forg':36B,40B 'jvm':16B 'kotlin':17B 'ktor':18B,23B 'packag':19B 'session':21B,30B,38B,41B,55B 'session-cooki':20B 'store':52B 'tamper':28B 'user':46B 'version':24B","search_c":"'3.6.1':60C 'cooki':69C 'encrypt':67C 'forgeri':62C 'jetbrain':57C 'ktor':58C 'possibl':64C 'session':61C,68C 'tamper':66C 'via':65C","first_public_at":"2026-11-06T11:17:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cvss_by":"cve@jetbrains.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123317","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123317","severity":null,"published_at":"2026-11-06T11:17:11+00:00","modified_at":"2026-11-06T11:17:11+00:00","first_seen_at":"2026-11-06T11:41:26+00:00","fetched_at":"2026-11-06T11:41:26+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}