PT-2026-38363 · Unknown · Katalyst-Koi

Published 2026-05-07 · Updated 2026-05-07 · CVE-2026-44511

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Katalyst Koi versions prior to 5.6.0 Katalyst Koi versions prior to 4.20.0

Description Admin session cookies are not invalidated upon logout. This allows an attacker who has obtained a valid admin session cookie—through exposure, caching, or interception—to maintain access to administrative functionality until the cookie expires or session secrets are rotated. This issue is a form of session replay, where a previously valid session is reused to gain unauthorized access.

Recommendations Upgrade to version 5.6.0 or later. Upgrade to version 4.20.0 or later.

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2026-44511

GHSA-4CX3-3C38-J9VV

Affected Products

Katalyst-Koi

References · 5

• https://osv.dev/vulnerability/GHSA-4cx3-3c38-j9vv · Vendor Advisory
• https://github.com/katalyst/koi/security/advisories/GHSA-4cx3-3c38-j9vv · Note
• https://twitter.com/dailycve/status/2052262689947201654 · Twitter Post
• https://github.com/katalyst/koi · Note
• https://guides.rubyonrails.org/v5.2.0/security.html#replay-attacks-for-cookiestore-sessions · Note