CVE-2018-1000814: aiohttp-session Non-expiring sessions / Infinite lifespan
Summary
CVE-2018-1000814: aio-libs aiohttp-session version 2.6.0 and earlier contains a Other/Unknown vulnerability in EncryptedCookieStorage and NaClCookieStorage that can result in Non-expiring sessions / Infinite lifespan. Affects aiohttp-session versions < 2.7.0. Fixed in 2.7.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
aiohttp-session is a Python package available on PyPI that provides session support for aiohttp web applications. It allows developers to manage user sessions and store session data securely. The package utilizes different storage options, including EncryptedCookieStorage and NaClCookieStorage, to store session information. These storage options use cookies to maintain session state between client and server.
Vulnerability Detail
The vulnerability (CVE-2018-1000814) in aiohttp-session versions 2.6.0 and earlier lies in the EncryptedCookieStorage and NaClCookieStorage implementations. It allows for non-expiring sessions or infinite lifespan. An attacker can exploit this vulnerability by recreating a cookie with the same value after its expiry. This means that even after a session should have expired, an attacker can continue to use the same session indefinitely, potentially gaining unauthorized access or performing malicious actions on behalf of the user.
How To Fix
Latest published version: 2.12.1 as of 22 Oct 2026
pip install --upgrade "aiohttp-session==2.12.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.7.0
This is the first release that contains the fix.
pip install --upgrade "aiohttp-session==2.7.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in aiohttp-session versions 2.6.0 and earlier allows for non-expiring sessions or infinite lifespan. Upgrading to version 2.7.0 or later is recommended to fix this issue. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for aiohttp-session →
FAQ
aiohttp-session is a Python package that provides session support for aiohttp web applications. It allows developers to manage user sessions and store session data securely.
The vulnerability allows for non-expiring sessions or infinite lifespan. An attacker can continue to use the same session even after it should have expired, potentially gaining unauthorized access or performing malicious actions on behalf of the user.
To fix this vulnerability, upgrade to aiohttp-session version 2.7.0 or later.
No specific workarounds have been mentioned for this vulnerability.
You can find more information about this vulnerability in the aiohttp-session advisory database: https://github.com/pypa/advisory-database/blob/main/vulns/aiohttp-session/PYSEC-2018-35.yaml
References
Related vulnerabilities
Recent vulnerabilities recorded for aiohttp-session.
