---
id: CVE-2025-64100
aliases:
  - GHSA-2hvh-cw5c-8q8q
  - PYSEC-2026-1246
title: CKAN vulnerable to fixed session IDs
summary: CKAN vulnerable to fixed session IDs
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N'
vendor: ckan
product: ckan
ecosystem: pip
affected:
  - 'ckan >= 2.10.0, < 2.10.9'
  - 'ckan >= 2.11.0, < 2.11.4'
patched:
  - ckan 2.10.9
  - ckan 2.11.4
published: '2025-10-29'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-2hvh-cw5c-8q8q'
references:
  - url: 'https://github.com/ckan/ckan/security/advisories/GHSA-2hvh-cw5c-8q8q'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-64100'
  - url: >-
      https://github.com/ckan/ckan/commit/c2fe437f88be850a6edf7a32470772428819fab5
  - url: 'https://github.com/ckan/ckan'
tags:
  - osv
  - pip
epss: 0.00278
epssPercentile: 0.17962
ingestedAt: '2026-07-08T18:25:44.529Z'
---

## Overview

### Impact

Session ids could be fixed by an attacker if the site is configured with server-side session storage (CKAN uses cookie-based session storage by default). The attacker would need to either set a cookie on the victim's browser or steal the victim's currently valid session. Session identifiers are now regenerated after each login.

### Patches
This vulnerability has been fixed in CKAN 2.10.9 and 2.11.4

### References
[https://en.wikipedia.org/wiki/Session_fixation](https://en.wikipedia.org/wiki/Session_fixation)

## Affected packages

- `ckan >= 2.10.0, < 2.10.9`
- `ckan >= 2.11.0, < 2.11.4`

## Remediation

Upgrade to a patched release:

- `ckan 2.10.9`
- `ckan 2.11.4`