Session fixation in fastify-passport
CVE-2023-29019
8.1HIGH
What is CVE-2023-29019?
The @fastify/passport library for Fastify applications is susceptible to session fixation attacks when used for user authentication alongside @fastify/session for managing sessions. Malicious actors can exploit this vulnerability by injecting a valid sessionId cookie and tricking victims into logging in, allowing attackers to hijack active sessions. Recent versions of @fastify/passport address this issue by regenerating sessionId upon successful login, mitigating the risk of the attack. Users are strongly encouraged to upgrade to the latest versions to protect their applications.
Affected Version(s)
fastify-passport < 1.1.0 < 1.1.0
fastify-passport >= 2.0.0, < 2.3.0 < 2.0.0, 2.3.0