CVE-2026-79313
UnknownSummary
webpy web.py 0.76 is vulnerable to Insufficient Session Expiration. The application's session management relies on periodic cleanup to expire sessions instead of checking the last-access time when a session is loaded. As a result, an expired session whose record has not yet been cleaned up can still be replayed and used, allowing an attacker holding a previously valid session cookie to continue accessing protected resources after the configured idle timeout.
Risk Assessment
An attacker with a captured session cookie can gain unauthorized access to protected resources even after the idle timeout has passed.
Recommendation
Upgrade web.py to a version that checks last-access time on session load, or implement custom session expiration checks.
Other vulnerabilities in web.py
See all- CVE-2026-79312Medium
webpy web.py 0.76 is vulnerable to Session Fixation. The Session._load() component reads session_id directly from the request cookie and loads that session from the store, and _save() writes back under the same session_id; there is no rotation after authentication, so a fixed session_id keeps the authenticated state.
- CVE-2026-79311Unknown
webpy web.py 0.76 is vulnerable to Cross Site Scripting (XSS) via render_jinja.__init__().
Original NVD description (English source)
webpy web.py 0.76 is vulnerable to Insufficient Session Expiration. The application's session management relies on periodic cleanup to expire sessions instead of checking the last-access time when a session is loaded. As a result, an expired session whose record has not yet been cleaned up can still be replayed and used, allowing an attacker holding a previously valid session cookie to continue accessing protected resources after the configured idle timeout.