AIKIDO-2024-10422
fastapi-sso is vulnerable to Improper Authentication
91
Critical Risk
This Affects:
fastapi-ssoTL;DR
A race condition bug exists in the login flow that, in rare cases, could allow one user to assume the identity of another due to concurrent login attempts. This vulnerability arises when multiple users try to log in at the same time, leading to incorrect session handling and potential session fixation, allowing an attacker to hijack another user's session.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
fastapi-sso is vulnerable to Improper Authentication in versions 0.2.3 - 0.15.0.
How to fix this
Upgrade the fastapi-sso library to the patch version. To fully support this fix, users must now use the SSO instance within an async context manager. This adjustment is necessary for proper handling of asynchronous operations.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant