@fastify/secure-session versions 7.5.0 through 8.4.1 have a vulnerability where, if configured with the signed cookie option, the plugin decrypts session cookies even when their signature verification fails. This allows an attacker who possesses an unexpired encrypted session cookie to bypass signature checks by stripping the obsolete signature and continue using the session. The attacker cannot forge session data, extend expiry, or survive encryption key rotation. The issue is fixed in version 8.4.2.