Threats tagged 'ghsa-9q3x-j473-5399'

SafeLine versions up to 9.4.1 use a cryptographically weak pseudo-random number generator seeded by time to derive the management console session-signing secret. This weakness allows unauthenticated remote attackers who can estimate the installation timestamp to reconstruct the secret offline and forge valid administrator session cookies, potentially gaining control over protected sites.