CVE-2026-19896
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
In the dtale tool (mangroup) up to version 3.22.0, a vulnerability was found in the build_secret_key function in dtale/app.py, related to Flask session cookies. The issue is insufficiently random values, which may allow an attacker to predict the session key. The attack is remote but requires high complexity. The exploit has been published, and a pull request with a fix awaits acceptance.
Risk Assessment
Predictable session keys can allow an attacker to impersonate users and hijack sessions, potentially leading to unauthorized access to data.
Recommendation
Apply the fix urgently or temporarily restrict access to the application, and consider using a secure random generator.
Original NVD description (English source)
A flaw has been found in mangroup dtale up to 3.22.0. This vulnerability affects the function build_secret_key of the file dtale/app.py of the component Flask Session Cookie. This manipulation causes insufficiently random values. Remote exploitation of the attack is possible. The attack's complexity is rated as high. It is stated that the exploitability is difficult. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance.