AIKIDO-2025-10939

TL;DR

Affected versions of this package are vulnerable due to the use of MD5, a weak cryptographic hash function, for hashing session IDs in the new_store_file method, which allows attackers to exploit MD5's known collision vulnerabilities to generate different session IDs that hash to the same value as legitimate ones, potentially leading to session hijacking or unauthorized access to session files. An attacker could craft malicious session IDs that collide with targeted ones, enabling authentication bypass or access to other users' sessions.