CVE-2024-2260
Session Fixation Vulnerability in zenml-io/zenml
A session fixation vulnerability exists in the zenml-io/zenml application, where JWT tokens used for user authentication are not invalidated upon logout. This flaw allows an attacker to bypass authentication mechanisms by reusing a victim's JWT token.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Session Fixation Vulnerability in zenml-io/zenml
A session fixation vulnerability exists in the zenml-io/zenml application, where JWT tokens used for user authentication are not invalidated upon logout. This flaw allows an attacker to bypass authentication mechanisms by reusing a victim's JWT token.
- Record
CVE-2024-2260- CVSS 3.0
- 4.2 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-384
- Updated
- 2026-11-02
EUVDEUVD-2024-1199
A session fixation vulnerability exists in the zenml-io/zenml application, where JWT tokens used for user authentication are not invalidated upon logout. This flaw allows an attacker to bypass authentication mechanisms by reusing a victim's JWT token.
- Record
EUVD-2024-1199- CVSS 3.0
- 4.2 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-g3r5-72hf-p7p2
zenml Session Fixation vulnerability
A session fixation vulnerability exists in the zenml-io/zenml application, where JWT tokens used for user authentication are not invalidated upon logout. This flaw allows an attacker to bypass authentication mechanisms by reusing a victim's JWT token.
- Record
GHSA-g3r5-72hf-p7p2- CVSS 3.0
- 4.2 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-384
- Updated
- 2026-11-02
NVD
A session fixation vulnerability exists in the zenml-io/zenml application, where JWT tokens used for user authentication are not invalidated upon logout. This flaw allows an attacker to bypass authentication mechanisms by reusing a victim's JWT token.
- Record
CVE-2024-2260- CVSS 3.1
- 4.2 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N - CVSS 3.0
- 4.2 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-384
- Updated
- 2026-11-02
OSV
Session Fixation Vulnerability in zenml-io/zenml
A session fixation vulnerability exists in the zenml-io/zenml application, where JWT tokens used for user authentication are not invalidated upon logout. This flaw allows an attacker to bypass authentication mechanisms by reusing a victim's JWT token.
- Record
CVE-2024-2260- CVSS 3.0
- 4.2 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-384
- Updated
- 2026-11-02
OSVGHSA-g3r5-72hf-p7p2
zenml Session Fixation vulnerability
A session fixation vulnerability exists in the zenml-io/zenml application, where JWT tokens used for user authentication are not invalidated upon logout. This flaw allows an attacker to bypass authentication mechanisms by reusing a victim's JWT token.
- Record
GHSA-g3r5-72hf-p7p2- CVSS 3.0
- 4.2 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-384
- Updated
- 2026-11-02
OSVPYSEC-2024-254
A session fixation vulnerability exists in the zenml-io/zenml application, where JWT tokens used for user authentication are not invalidated upon logout. This flaw allows an attacker to bypass authentication mechanisms by reusing a victim's JWT token.
- Record
PYSEC-2024-254- CVSS 3.1
- 4.2 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
zenmlPyPI |
before 0.56.2 | 0.56.2 |
zenmlPyPI |
before 0.56.2, plus listed versions 0.0.1rc10.0.1rc20.1.00.1.10.1.2 Show 45 moreShow less0.1.30.1.3rc00.1.40.1.50.10.00.11.00.12.00.13.00.13.10.13.20.2.00.2.0rc10.2.0rc20.20.00.20.0rc10.20.10.20.20.20.30.20.40.20.50.21.00.21.10.22.00.23.00.3.10.3.1rc00.3.20.3.30.3.3rc00.3.40.3.4rc00.3.50.3.5rc00.3.60.3.6.10.3.6rc00.3.70.3.7.1rc00.3.7.1rc10.3.7.1rc30.3.7.1rc40.3.7rc00.3.80.3.9rc10.3.9rc2 |
0.56.2 |
zenmlPyPI |
before 0.56.2, plus listed versions 0.0.1rc10.0.1rc20.1.00.1.10.1.2 Show 45 moreShow less0.1.30.1.3rc00.1.40.1.50.10.00.11.00.12.00.13.00.13.10.13.20.2.00.2.0rc10.2.0rc20.20.00.20.0rc10.20.10.20.20.20.30.20.40.20.50.21.00.21.10.22.00.23.00.3.10.3.1rc00.3.20.3.30.3.3rc00.3.40.3.4rc00.3.50.3.5rc00.3.60.3.6.10.3.6rc00.3.70.3.7.1rc00.3.7.1rc10.3.7.1rc30.3.7.1rc40.3.7rc00.3.80.3.9rc10.3.9rc2 |
0.56.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-2260 is a medium vulnerability (CVSS 4.2) in Zenml, published April 16, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.43%, the 37th percentile. Fixed in zenml 0.56.2.
References
huntr.com/bounties/2d0856ec-ed73-477a-8ea2-d5d4f15cf167
github.com/zenml-io/zenml/commit/68bcb3ba60cba9729c9713a49c39502d40fb945e
nvd.nist.gov/vuln/detail/CVE-2024-2260
Left out here: 165 versions. The JSON record has them.