CVE-2025-64100Medium· 6.1▾ SunlitCKAN vulnerable to fixed session IDs
▾ Sunlit zone — Low / medium · no exploitation signal
impact 33.6 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.3%
0.3% → 0.3%
Session ids could be fixed by an attacker if the site is configured with server-side session storage (CKAN uses cookie-based session storage by default). The attacker would need to either set a cookie on the victim's browser or steal the victim's currently valid session. Session identifiers are now regenerated after each login.
This vulnerability has been fixed in CKAN 2.10.9 and 2.11.4
https://en.wikipedia.org/wiki/Session_fixation
ckan >= 2.10.0, < 2.10.9ckan >= 2.11.0, < 2.11.4Upgrade to a patched release:
ckan 2.10.9ckan 2.11.4Connected by shared product, vendor, weakness, or advisory.
CVE-2023-32321Critical· 9.8Ckan remote code execution and private information access via crafted resource ids
CVE-2026-41132MediumCKAN has no certificate validation on STMP connection
CVE-2026-41255Medium· 6.1CKAN has CSRF exemption primed by anonymous requests
CVE-2026-42031HighCKAN has Unauthenticated SQL Injection and Authorization Bypass in `datastore_search_sql`
CVE-2026-42032MediumCKAN has Unauthenticated Authorization Bypass in `datastore_search_sql`
CVE-2024-41675Medium· 6.8CKAN has Cross-site Scripting vector in the Datatables view plugin