CVE-2025-64100
CKAN Vulnerable to Session Cookie Fixation
CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.9 and 2.11.4, session ids could be fixed by an attacker if the site is configured with server-side session storage (CKAN uses cookie-based session storage by default). The attacker would need to either set a cookie on the victim's browser or steal the victim's currently valid session. Session identifiers are now regenerated after each login. This vulnerability has been fixed in CKAN 2.10.9 and 2.11.4
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
CKAN Vulnerable to Session Cookie Fixation
CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.9 and 2.11.4, session ids could be fixed by an attacker if the site is configured with server-side session storage (CKAN uses cookie-based session storage by default). The attacker would need to either set a cookie on the victim's browser or steal the victim's currently valid session. Session identifiers are now regenerated after each login. This vulnerability has been fixed in CKAN 2.10.9 and 2.11.4
- Record
CVE-2025-64100- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N - Weakness
- CWE-384
- Updated
- 2026-11-02
EUVDEUVD-2025-36700
CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.9 and 2.11.4, session ids could be fixed by an attacker if the site is configured with server-side session storage (CKAN uses cookie-based session storage by default). The attacker would need to either set a cookie on the victim's browser or steal the victim's currently valid session. Session identifiers are now regenerated after each login. This vulnerability has been fixed in CKAN 2.10.9 and 2.11.4
- Record
EUVD-2025-36700- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-2hvh-cw5c-8q8q
CKAN vulnerable to fixed session IDs
Impact
Session ids could be fixed by an attacker if the site is configured with server-side session storage (CKAN uses cookie-based session storage by default). The attacker would need to either set a cookie on the victim's browser or steal the victim's currently valid session. Session identifiers are now regenerated after each login.
Patches
This vulnerability has been fixed in CKAN 2.10.9 and 2.11.4
References
- Record
GHSA-2hvh-cw5c-8q8q- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N - Weakness
- CWE-384
- Updated
- 2026-11-02
NVD
CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.9 and 2.11.4, session ids could be fixed by an attacker if the site is configured with server-side session storage (CKAN uses cookie-based session storage by default). The attacker would need to either set a cookie on the victim's browser or steal the victim's currently valid session. Session identifiers are now regenerated after each login. This vulnerability has been fixed in CKAN 2.10.9 and 2.11.4
- Record
CVE-2025-64100- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N - Weakness
- CWE-384
- Updated
- 2026-11-02
OSV
CKAN Vulnerable to Session Cookie Fixation
CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.9 and 2.11.4, session ids could be fixed by an attacker if the site is configured with server-side session storage (CKAN uses cookie-based session storage by default). The attacker would need to either set a cookie on the victim's browser or steal the victim's currently valid session. Session identifiers are now regenerated after each login. This vulnerability has been fixed in CKAN 2.10.9 and 2.11.4
- Record
CVE-2025-64100- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N - Weakness
- CWE-384
- Updated
- 2026-11-02
OSVGHSA-2hvh-cw5c-8q8q
CKAN vulnerable to fixed session IDs
Impact
Session ids could be fixed by an attacker if the site is configured with server-side session storage (CKAN uses cookie-based session storage by default). The attacker would need to either set a cookie on the victim's browser or steal the victim's currently valid session. Session identifiers are now regenerated after each login.
Patches
This vulnerability has been fixed in CKAN 2.10.9 and 2.11.4
References
- Record
GHSA-2hvh-cw5c-8q8q- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N - Weakness
- CWE-384
- Updated
- 2026-11-02
OSVPYSEC-2026-1246
CKAN vulnerable to fixed session IDs
Impact
Session ids could be fixed by an attacker if the site is configured with server-side session storage (CKAN uses cookie-based session storage by default). The attacker would need to either set a cookie on the victim's browser or steal the victim's currently valid session. Session identifiers are now regenerated after each login.
Patches
This vulnerability has been fixed in CKAN 2.10.9 and 2.11.4
References
- Record
PYSEC-2026-1246- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ckanPyPI |
2.10.0 up to 2.10.9 | 2.10.9 |
ckanPyPI |
2.11.0 up to 2.11.4 | 2.11.4 |
ckanPyPI |
2.10.0 up to 2.10.9, plus listed versions 2.10.12.10.32.10.42.10.52.10.62.10.72.10.8 |
2.10.9 |
ckanPyPI |
2.11.0 up to 2.11.4, plus listed versions 2.11.12.11.22.11.3 |
2.11.4 |
ckanPyPI |
2.10.0 up to 2.10.9, 2.11.0 up to 2.11.4, plus listed versions 2.10.12.10.32.10.42.10.52.10.6 Show 5 moreShow less2.10.72.10.82.11.12.11.22.11.3 |
2.10.92.11.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-64100 is a medium vulnerability (CVSS 6.1) in Ckan, published October 29, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.30%, the 22nd percentile. Fixed in ckan 2.10.9.
References
github.com/ckan/ckan/security/advisories/GHSA-2hvh-cw5c-8q8q
nvd.nist.gov/vuln/detail/CVE-2025-64100
pypi.org/project/ckan