What’s Vulnerable › Vulnerabilities

CVE-2024-2260: Session Fixation Vulnerability in zenml-io/zenml

• Severity: medium (CVSS 4.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-04-16 · updated 2026-06-17
• Weakness: CWE-384

Description

A session fixation vulnerability exists in the zenml-io/zenml application, where JWT tokens used for user authentication are not invalidated upon logout. This flaw allows an attacker to bypass authentication mechanisms by reusing a victim's JWT token.

Affected products

• zenml-io/zenml: before 0.56.2 — fixed in 0.56.2

How to fix

Upgrade to a fixed version: zenml-io/zenml 0.56.2. Check the vendor advisory for mitigations.

References

• https://github.com/zenml-io/zenml/commit/68bcb3ba60cba9729c9713a49c39502d40fb945e
• https://huntr.com/bounties/2d0856ec-ed73-477a-8ea2-d5d4f15cf167
• https://github.com/zenml-io/zenml/commit/68bcb3ba60cba9729c9713a49c39502d40fb945e
• https://huntr.com/bounties/2d0856ec-ed73-477a-8ea2-d5d4f15cf167

Get alerted when CVE-2024-2260 or the next vulnerability affects your stack