PT-2026-53448 · Pypi · Ipsilon

Published 2026-06-29 · Updated 2026-06-29

OSV

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

A vulnerability in ipsilon 2.0 before 2.0.2, 1.2 before 1.2.1, 1.1 before 1.1.2, and 1.0 before 1.0.3 was found that allows attacker to log out active sessions of other users. This issue is related to how it tracks sessions, and allows an unauthenticated attacker to view and terminate active sessions from other users. It is also called a "SAML2 multi-session vulnerability."

Fix

Related Identifiers

PYSEC-2026-360

Affected Products

Ipsilon

References · 18

• https://osv.dev/vulnerability/PYSEC-2026-360 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-8638 · Security Note
• https://github.com/ipsilon-project/ipsilon · Note
• https://github.com/ipsilon-project/ipsilon/commit/1c48414877fc110652b6078a29529972c7ec9122 · Note
• https://github.com/ipsilon-project/ipsilon/commit/64fc366c054fc6af1d9d2692902db169884b5f78 · Note
• https://github.com/ipsilon-project/ipsilon/commit/a33303b6beb5c316d7c18b23566b7666a4e307a4 · Note
• https://github.com/ipsilon-project/ipsilon/commit/b4744a92d4fa7f6d7ade0ae2d99a2dc0ea94734d · Note
• https://access.redhat.com/errata/RHSA-2016:2809 · Note
• https://ipsilon-project.org/advisory/CVE-2016-8638.txt · Note
• https://ipsilon-project.org/release/2.1.0.html · Note
• http://rhn.redhat.com/errata/RHSA-2016-2809.html · Note
• https://pagure.io/ipsilon/c/511fa8b7001c2f9a42301aa1d4b85aaf170a461c · Note
• http://securityfocus.com/bid/94439 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1392829 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8638 · Note