Improper validation of integrity check value in Ktor - CVE-2026-123317
Published: November 6, 2026
Vulnerability identifier: #VU159682
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-123317
CWE-ID: CWE-354
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to forge sessions using tampered encrypted session cookies.
The vulnerability exists due to improper validation of integrity check values in Ktor's encrypted session cookie handling when processing tampered cookies. A remote attacker can modify encrypted session cookies to forge sessions and potentially gain unauthorized access.
Affected software
Ktor
How to mitigate CVE-2026-123317
Install security update from vendor's website.
Ktor - update to 3.6.1