{"cve":"CVE-2026-55617","nvd":{"published":"2026-09-15T15:17:18.930","modified":"2026-09-30T17:51:56.193","status":"Deferred","description":"Hydro is a next-generation high-performance online judge platform. From 4.10.4 until 5.0.2, the session recreation logic in packages/hydrooj/src/service/layers/base.ts creates a replacement session token without deleting the previous token from the server-side session token store, so an old sid cookie can remain valid after logout or another renewal flow. An attacker who possesses a victim's previously valid stale cookie can replay it over HTTP or HTTPS without knowing the victim's username or password and without victim interaction at exploitation time. Successful replay can take over the victim's account, disclose private data, and permit unauthorized modification or deletion of data available to that account. This issue is fixed in version 5.0.2.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","score":6.9},"cvss_v3":null,"cwes":["CWE-613"],"references":["https://github.com/hydro-dev/Hydro/commit/8450390fcce5f7dc3f11c43a14f1d76dbb949a0d","https://github.com/hydro-dev/Hydro/commit/8d76be8f0b83d911bf7671962b0467e9d4b5719a","https://github.com/hydro-dev/Hydro/pull/1173","https://github.com/hydro-dev/Hydro/security/advisories/GHSA-94jp-7776-qj6q"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:53:43.293028046+00:00"},"epss":{"cve":"CVE-2026-55617","score":0.00473,"percentile":0.40639,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-94jp-7776-qj6q","url":"https://osv.dev/vulnerability/GHSA-94jp-7776-qj6q","summary":"Hydro: Insufficient session expiration when recreating sessions","modified":"2026-06-18T13:26:30.193032Z","packages":[{"ecosystem":"npm","name":"hydrooj","purl":"pkg:npm/hydrooj","ranges":[">=4.10.4 <5.0.2"],"fixed":["5.0.2"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}