Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
2 vulnerabilities found for Hydro by hydro-dev
CVE-2026-55617 (GCVE-0-2026-55617)
Vulnerability from nvd – Published: 2026-09-15 14:45 – Updated: 2026-09-15 18:02
VLAI
EPSS
VEX
Title
Hydro: Insufficient session expiration when recreating sessions
Summary
Hydro is a next-generation high-performance online judge platform. From 4.10.4 until 5.0.2, the session recreation logic in packages/hydrooj/src/service/layers/base.ts creates a replacement session token without deleting the previous token from the server-side session token store, so an old sid cookie can remain valid after logout or another renewal flow. An attacker who possesses a victim's previously valid stale cookie can replay it over HTTP or HTTPS without knowing the victim's username or password and without victim interaction at exploitation time. Successful replay can take over the victim's account, disclose private data, and permit unauthorized modification or deletion of data available to that account. This issue is fixed in version 5.0.2.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-15 17:38 UTC
CWE
- CWE-613 - Insufficient Session Expiration
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/hydro-dev/Hydro/security/advis… | x_refsource_CONFIRM |
| https://github.com/hydro-dev/Hydro/pull/1173 | x_refsource_MISC |
| https://github.com/hydro-dev/Hydro/commit/8450390… | x_refsource_MISC |
| https://github.com/hydro-dev/Hydro/commit/8d76be8… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55617",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-15T17:38:23.906162Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T18:02:57.088Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Hydro",
"vendor": "hydro-dev",
"versions": [
{
"status": "affected",
"version": "\u003e= 4.10.4, \u003c 5.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Hydro is a next-generation high-performance online judge platform. From 4.10.4 until 5.0.2, the session recreation logic in packages/hydrooj/src/service/layers/base.ts creates a replacement session token without deleting the previous token from the server-side session token store, so an old sid cookie can remain valid after logout or another renewal flow. An attacker who possesses a victim\u0027s previously valid stale cookie can replay it over HTTP or HTTPS without knowing the victim\u0027s username or password and without victim interaction at exploitation time. Successful replay can take over the victim\u0027s account, disclose private data, and permit unauthorized modification or deletion of data available to that account. This issue is fixed in version 5.0.2."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-613",
"description": "CWE-613: Insufficient Session Expiration",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T14:45:11.664Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/hydro-dev/Hydro/security/advisories/GHSA-94jp-7776-qj6q",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/hydro-dev/Hydro/security/advisories/GHSA-94jp-7776-qj6q"
},
{
"name": "https://github.com/hydro-dev/Hydro/pull/1173",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hydro-dev/Hydro/pull/1173"
},
{
"name": "https://github.com/hydro-dev/Hydro/commit/8450390fcce5f7dc3f11c43a14f1d76dbb949a0d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hydro-dev/Hydro/commit/8450390fcce5f7dc3f11c43a14f1d76dbb949a0d"
},
{
"name": "https://github.com/hydro-dev/Hydro/commit/8d76be8f0b83d911bf7671962b0467e9d4b5719a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hydro-dev/Hydro/commit/8d76be8f0b83d911bf7671962b0467e9d4b5719a"
}
],
"source": {
"advisory": "GHSA-94jp-7776-qj6q",
"discovery": "UNKNOWN"
},
"title": "Hydro: Insufficient session expiration when recreating sessions"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55617",
"datePublished": "2026-09-15T14:45:11.664Z",
"dateReserved": "2026-06-16T23:31:22.446Z",
"dateUpdated": "2026-09-15T18:02:57.088Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55617 (GCVE-0-2026-55617)
Vulnerability from cvelistv5 – Published: 2026-09-15 14:45 – Updated: 2026-09-15 18:02
VLAI
EPSS
VEX
Title
Hydro: Insufficient session expiration when recreating sessions
Summary
Hydro is a next-generation high-performance online judge platform. From 4.10.4 until 5.0.2, the session recreation logic in packages/hydrooj/src/service/layers/base.ts creates a replacement session token without deleting the previous token from the server-side session token store, so an old sid cookie can remain valid after logout or another renewal flow. An attacker who possesses a victim's previously valid stale cookie can replay it over HTTP or HTTPS without knowing the victim's username or password and without victim interaction at exploitation time. Successful replay can take over the victim's account, disclose private data, and permit unauthorized modification or deletion of data available to that account. This issue is fixed in version 5.0.2.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-15 17:38 UTC
CWE
- CWE-613 - Insufficient Session Expiration
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/hydro-dev/Hydro/security/advis… | x_refsource_CONFIRM |
| https://github.com/hydro-dev/Hydro/pull/1173 | x_refsource_MISC |
| https://github.com/hydro-dev/Hydro/commit/8450390… | x_refsource_MISC |
| https://github.com/hydro-dev/Hydro/commit/8d76be8… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55617",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-15T17:38:23.906162Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T18:02:57.088Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Hydro",
"vendor": "hydro-dev",
"versions": [
{
"status": "affected",
"version": "\u003e= 4.10.4, \u003c 5.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Hydro is a next-generation high-performance online judge platform. From 4.10.4 until 5.0.2, the session recreation logic in packages/hydrooj/src/service/layers/base.ts creates a replacement session token without deleting the previous token from the server-side session token store, so an old sid cookie can remain valid after logout or another renewal flow. An attacker who possesses a victim\u0027s previously valid stale cookie can replay it over HTTP or HTTPS without knowing the victim\u0027s username or password and without victim interaction at exploitation time. Successful replay can take over the victim\u0027s account, disclose private data, and permit unauthorized modification or deletion of data available to that account. This issue is fixed in version 5.0.2."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-613",
"description": "CWE-613: Insufficient Session Expiration",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T14:45:11.664Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/hydro-dev/Hydro/security/advisories/GHSA-94jp-7776-qj6q",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/hydro-dev/Hydro/security/advisories/GHSA-94jp-7776-qj6q"
},
{
"name": "https://github.com/hydro-dev/Hydro/pull/1173",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hydro-dev/Hydro/pull/1173"
},
{
"name": "https://github.com/hydro-dev/Hydro/commit/8450390fcce5f7dc3f11c43a14f1d76dbb949a0d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hydro-dev/Hydro/commit/8450390fcce5f7dc3f11c43a14f1d76dbb949a0d"
},
{
"name": "https://github.com/hydro-dev/Hydro/commit/8d76be8f0b83d911bf7671962b0467e9d4b5719a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hydro-dev/Hydro/commit/8d76be8f0b83d911bf7671962b0467e9d4b5719a"
}
],
"source": {
"advisory": "GHSA-94jp-7776-qj6q",
"discovery": "UNKNOWN"
},
"title": "Hydro: Insufficient session expiration when recreating sessions"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55617",
"datePublished": "2026-09-15T14:45:11.664Z",
"dateReserved": "2026-06-16T23:31:22.446Z",
"dateUpdated": "2026-09-15T18:02:57.088Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}