Session Fixation Vulnerability Affects Chatwoot Prior to 2.4.0

CVE-2021-3740

Summary

A vulnerability exists in Chatwoot where the application fails to invalidate existing sessions on other devices when a user updates their password. This behavior allows previously authenticated sessions to remain active, creating potential opportunities for unauthorized access if an attacker obtains a valid session token. Organizations using affected versions of Chatwoot should consider updating to the latest version to mitigate the risks associated with session persistence.

References