CVE-2024-4680Low· 3.9▾ Sunlitzenml-io/zenml does not expire the session after password reset
▾ Sunlit zone — Low / medium · no exploitation signal
impact 21.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.4%
0.4% → 0.4%
A vulnerability in zenml-io/zenml version 0.56.3 allows attackers to reuse old session credentials or session IDs due to insufficient session expiration. Specifically, the session does not expire after a password change, enabling an attacker to maintain access to a compromised account without the victim's ability to revoke this access. This issue was observed in a self-hosted ZenML deployment via Docker, where after changing the password from one browser, the session remained active and usable in another browser without requiring re-authentication.
zenml <= 0.56.3Refer to the advisory for the patched release.
Connected by shared product, vendor, weakness, or advisory.
CVE-2024-25723Medium· 6.5ZenML Server Remote Privilege Escalation Vulnerability
CVE-2025-8406Medium· 6.3ZenML is vulnerable to Path Traversal through its `PathMaterializer` class
CVE-2024-4311Medium· 5.4Missing ratelimit on passwrod resets in zenml
CVE-2024-4460Medium· 4.3Improper line feed handling in zenml