CVE-2018-1000519: aiohttp-session Session Fixation Vulnerability
Summary
CVE-2018-1000519: aio-libs aiohttp-session contains a Session Fixation vulnerability in load_session function for RedisStorage (see: https://github.com/aio-libs/aiohttp-session/blob/master/aiohttp_session/redis_storage.py#L42) that can re... Affects aiohttp-session versions < 2.4.0. Fixed in 2.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
aiohttp-session is a Python package available on PyPI that provides session management for aiohttp web applications. It allows developers to store and retrieve session data using different storage backends, including Redis. The vulnerability identified as CVE-2018-1000519 affects aiohttp-session when using RedisStorage as the session storage backend.
Vulnerability Detail
The vulnerability in aiohttp-session allows for Session Fixation attacks. The issue lies in the load_session function of the RedisStorage module. Attackers can exploit this vulnerability by setting session cookies using various methods, such as passing a session parameter in the URL (?session=<session_id>) or using meta tags or script tags with the Set-Cookie header. By manipulating the session cookies, an attacker can hijack user sessions and impersonate legitimate users, potentially gaining unauthorized access to sensitive information or performing malicious actions on behalf of the victim.
How To Fix
Latest published version: 2.12.1 as of 22 Oct 2026
pip install --upgrade "aiohttp-session==2.12.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.4.0
This is the first release that contains the fix.
pip install --upgrade "aiohttp-session==2.4.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the package is not immediately feasible, a temporary workaround is to avoid using RedisStorage as the session storage backend. Instead, developers can consider using other storage backends provided by aiohttp-session that are not affected by this vulnerability.
Conclusion
The aiohttp-session package is vulnerable to a Session Fixation attack when using RedisStorage as the session storage backend. Developers should update their package to version 2.4.0 or later to mitigate this vulnerability. If immediate updating is not possible, alternative storage backends can be used as a temporary workaround. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for aiohttp-session →
FAQ
aiohttp-session is a Python package that provides session management for aiohttp web applications. It allows developers to store and retrieve session data using different storage backends.
Session Fixation is an attack where an attacker sets a user's session identifier to a known value, allowing them to hijack the user's session and potentially gain unauthorized access.
This vulnerability can be exploited by manipulating session cookies. Attackers can set session cookies using various methods, such as passing a session parameter in the URL or using meta tags or script tags with the Set-Cookie header.
The consequences of this vulnerability include session hijacking, where an attacker can impersonate legitimate users and potentially gain unauthorized access to sensitive information or perform malicious actions on behalf of the victim.
Yes, developers can fix this vulnerability by updating their aiohttp-session package to version 2.4.0 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for aiohttp-session.
