CVE-2018-1000519: aiohttp-session Session Fixation vulnerability
Summary
CVE-2018-1000519: aiohttp-session Session Fixation vulnerability. Affects aiohttp-session versions < 2.4.0. Fixed in 2.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The aiohttp-session package is a Python package available on PyPI that provides session management functionality for aiohttp web applications. It allows developers to store and retrieve session data for individual users. The package is widely used in Python web development projects.
Vulnerability Detail
The aiohttp-session package before version 2.4.0 is affected by a Session Fixation vulnerability. This vulnerability exists in the load_session function of the RedisStorage module. An attacker can exploit this vulnerability to perform a Session Hijacking attack. The attack can be carried out through any method that allows setting session cookies, such as using a specially crafted URL parameter (?session=<>) or by injecting meta tags or script tags with the Set-Cookie header. The vulnerability has a CVSS score of 6.5, indicating a moderate severity level.
How To Fix
Latest published version: 2.12.1 as of 22 Oct 2026
pip install --upgrade "aiohttp-session==2.12.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.4.0
This is the first release that contains the fix.
pip install --upgrade "aiohttp-session==2.4.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version of the package as soon as possible.
Conclusion
The aiohttp-session package before version 2.4.0 is vulnerable to a Session Fixation attack. Developers should upgrade to version 2.4.0 or later to fix this vulnerability. For further assistance and support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for aiohttp-session →
FAQ
aiohttp-session is a Python package that provides session management functionality for aiohttp web applications.
A Session Fixation vulnerability allows an attacker to hijack a user's session by fixing or setting the session identifier to a known value.
An attacker can exploit this vulnerability by manipulating the session identifier through methods such as injecting a specially crafted URL parameter or injecting meta tags or script tags with the Set-Cookie header.
The impact of this vulnerability is Session Hijacking, where an attacker can take control of a user's session and perform actions on their behalf.
This vulnerability has a CVSS score of 6.5, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for aiohttp-session.
