CVE-2026-44511: katalyst-koi Session Cookie Replay Vulnerability
Summary
CVE-2026-44511: katalyst-koi: Session cookies can be replayed after user logout. Affects katalyst-koi across 2 version ranges.
< 4.20.0
>= 5.0.0, < 5.6.0
Fixed in 4.20.0 or 5.6.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Katalyst Koi is a Ruby on Rails-based framework that provides admin authentication features for web applications. It allows developers to manage user sessions and access control effectively. However, a critical vulnerability has been identified in its session management, specifically related to the handling of admin session cookies upon user logout.
Vulnerability Detail
The vulnerability arises from the failure to invalidate admin session cookies when an admin user logs out. This oversight allows an attacker with access to a valid admin session cookie to continue accessing admin functionalities even after the logout, posing a significant security risk. The issue primarily affects applications utilizing Koi admin authentication, where session cookies may have been exposed, cached, or intercepted.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.20.04.20.0gem install katalyst-koi -v 4.20.0 -
>= 5.0.0, < 5.6.05.6.0gem install katalyst-koi -v 5.6.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, Katalyst Koi recommends backporting the changes released in versions 5.6.0 and 4.20.0 to your current version. This involves implementing a mechanism to record the admin logout time and rejecting any session cookies created before the most recent logout.
Conclusion
The CVE-2026-44511 vulnerability in Katalyst Koi poses a significant risk due to the improper handling of admin session cookies. It is crucial for users to upgrade to the patched versions or implement the recommended workarounds to safeguard their applications from potential exploitation.
See every vulnerability recorded for katalyst-koi →
FAQ
The impact includes unauthorized access to admin functionalities using valid session cookies even after logout, which can lead to data breaches and unauthorized actions.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate upgrading is not possible, implement the recommended workaround to mitigate the risk until you can update.
Versions prior to 4.20.0 and 5.6.0 are affected by this vulnerability.
The CVSS score of this vulnerability is 7.4, indicating a high severity level.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
