Katalyst Koi is a Rails admin framework that had a session management flaw in versions prior to 4.20.0 and between 5.0.0 and 5.6.0. Specifically, admin session cookies were not invalidated on logout, allowing continued access with a valid cookie post-logout. This insufficient session expiration vulnerability (CWE-613) could enable unauthorized access to admin functions. The vulnerability is resolved in versions 4.20.0 and 5.6.0. No known exploits are reported in the wild. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impact.

An attacker who obtains a valid admin session cookie can maintain unauthorized access to admin functionality even after the legitimate admin user logs out. This can lead to unauthorized disclosure and modification of sensitive admin data. There is no impact on availability. The vulnerability affects confidentiality and integrity of the system.

Upgrade Katalyst Koi to version 4.20.0 or later, or 5.6.0 or later, where the session invalidation issue on logout is fixed. Since no official remediation level or patch links are provided, verify the upgrade path with the vendor or official releases. Until upgraded, consider rotating session secrets to invalidate existing session cookies. Patch status is not explicitly confirmed in the advisory; check vendor sources for current remediation guidance.