{"id":"CVE-2024-4680","aliases":["GHSA-99hm-86h7-gr3g","PYSEC-2026-2069"],"title":"zenml-io/zenml does not expire the session after password reset","summary":"zenml-io/zenml does not expire the session after password reset","severity":"low","cvss":3.9,"cvssVector":"CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L","vendor":"zenml","product":"zenml","ecosystem":"pip","affected":["zenml <= 0.56.3"],"published":"2024-06-08","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-99hm-86h7-gr3g","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-4680"},{"url":"https://github.com/zenml-io/zenml"},{"url":"https://huntr.com/bounties/c88f6bd2-490d-4930-98dd-03651b20230a"}],"tags":["osv","pip"],"epss":0.00408,"epssPercentile":0.34758,"ingestedAt":"2026-07-08T18:25:47.804Z","slug":"CVE-2024-4680","body":"## Overview\n\nA vulnerability in zenml-io/zenml version 0.56.3 allows attackers to reuse old session credentials or session IDs due to insufficient session expiration. Specifically, the session does not expire after a password change, enabling an attacker to maintain access to a compromised account without the victim's ability to revoke this access. This issue was observed in a self-hosted ZenML deployment via Docker, where after changing the password from one browser, the session remained active and usable in another browser without requiring re-authentication.\n\n## Affected packages\n\n- `zenml <= 0.56.3`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"sunlit","depthScore":22,"depthScoreParts":{"impact":21.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}