A critical session management flaw in web.py 0.76 allows attackers to hijack user sessions by replaying cookies that should have expired.

The session management mechanism relies on periodic cleanup rather than verifying the last-access time during session loading. This allows an unauthenticated attacker to reuse an expired session cookie to access protected resources before the server purges the session record.

This vulnerability enables unauthorized access to user accounts and sensitive application data, effectively bypassing authentication controls. With a CVSS score of 9.8, the potential for widespread account takeover and data exposure is significant. Organizations relying on web.py for session management are at high risk of identity hijacking.

Immediate Action: Review the application session management implementation and enforce server-side checks on the last-access time until an official update is released.

Proactive Monitoring: Monitor authentication logs for suspicious session activity, such as multiple accesses from different IP addresses under the same session ID.

Compensating Controls: Implement stricter session timeout policies and utilize secure, HttpOnly, and SameSite cookie attributes to limit the utility of intercepted session identifiers.

Public Exploit Available: No.

The reliance on periodic cleanup for session expiration is a fundamental design flaw in version 0.76. Developers should update their session management logic to validate session timestamps on every request. Please monitor the official web.py repository for forthcoming security patches and apply them as soon as they become available.