EUVD-2026-78768
GHSA-94jp-7776-qj6q
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects the prerequisite of obtaining a stale sid cookie; PR:N applies because no credential is needed at exploitation time; no availability impact is described.
Primary rating from Vendor (https://github.com/hydro-dev/Hydro).
CVSS VectorVendor: https://github.com/hydro-dev/Hydro
Lifecycle Timeline
3DescriptionCVE.org
Impact
Hydro contains an insufficient session expiration vulnerability in its session recreation logic. When a session is recreated, including during logout or other session renewal flows, Hydro creates a new session token but does not delete the previous server-side session token.
As a result, an old sid cookie may remain valid even after the legitimate user logs out or the session is recreated. An attacker who has obtained a victim's previous sid cookie can replay that cookie over HTTP or HTTPS and continue to access the affected Hydro instance as the victim.
The attacker does not need the victim's username or password. Exploitation requires possession of a previously valid stale sid cookie, but no user interaction is required at exploitation time.
Successful exploitation may allow account takeover within the affected Hydro instance. For a normal user account, this may allow disclosure of private data and unauthorized modification or deletion of data available to the victim.
Patches
The issue has been patched by deleting the old server-side session token before creating a new one during session recreation.
Patched in:
- Pull request: https://github.com/hydro-dev/Hydro/pull/1173
- Patch commit: https://github.com/hydro-dev/Hydro/commit/8450390fcce5f7dc3f11c43a14f1d76dbb949a0d
- Merge commit: https://github.com/hydro-dev/Hydro/commit/8d76be8f0b83d911bf7671962b0467e9d4b5719a
Users should upgrade to a version containing this patch.
Workarounds
If upgrading immediately is not possible, administrators should reduce the risk by forcing all existing sessions to expire or by clearing the server-side session token store after applying a local patch.
Administrators should also review logs for suspicious use of stale sid cookies and rotate any exposed session cookies. However, these mitigations do not fully fix the vulnerability. The recommended remediation is to upgrade to a patched version.
AnalysisAI
Session replay attacks against Hydro competitive programming judge instances become viable because logout and session renewal flows create new tokens without invalidating the previous server-side session. An attacker who has captured a victim's stale sid cookie - via network interception, browser theft, or prior session compromise - can replay that cookie over HTTP or HTTPS at any point after logout and retain full authenticated access as the victim. The vulnerability affects hydrooj npm package versions 4.10.4 through 5.0.1; no public exploit or KEV listing is identified, but the attack primitive is straightforward once a stale cookie is obtained.
Technical ContextAI
Hydro is an open-source competitive programming online judge platform distributed as the npm package hydrooj (CPE: pkg:npm/hydrooj). The vulnerability resides in the session middleware layer at packages/hydrooj/src/service/layers/base.ts. The root cause is CWE-613 (Insufficient Session Expiration): when session recreation is triggered - including on user logout - the application generates and assigns a new session token to a new server-side record but neglects to call token.del() against the prior session's _id before creating the replacement. This leaves the old session entry live in the server-side token store indefinitely. Because the sid cookie is a bearer token validated server-side, possession of the old cookie is sufficient to authenticate as the victim without any credential knowledge.
RemediationAI
The primary remediation is to upgrade hydrooj to version 5.0.2 or later, which contains the fix that calls token.del() on the previous session _id before creating a new session during recreation (patch commit: https://github.com/hydro-dev/Hydro/commit/8450390fcce5f7dc3f11c43a14f1d76dbb949a0d). If immediate upgrade is not feasible, administrators should force expiration of all existing sessions by clearing the server-side session token store entirely - this eliminates all currently live stale sessions but is a one-time mitigation that does not prevent new stale sessions from accumulating. Administrators should also review application access logs for suspicious reuse of session cookies originating from unexpected IP addresses or after a user's logout event. Enforcing TLS across all Hydro endpoints reduces the risk of cookie interception but does not address the underlying session invalidation flaw. These workarounds do not constitute a full fix; the vendor advisory explicitly states that upgrading to a patched version is the only complete remediation.
Same weakness CWE-613 – Insufficient Session Expiration
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today