Threats tagged 'ghsa-38jm-3ffc-942j'

A vulnerability exists where mechanism binding files generated during a shredding process for authentication are not functioning correctly, causing the same session token to be used for all token-based API users. This issue is similar to one fixed in version 2026.7.1 but was missed in that fix. The files are referenced by randomly generated UUIDs and exist only for a day, which limits the risk. The flaw renders the intended protection mechanism ineffective. The fix includes improved hardening of related code areas.