When @fastify/secure-session is configured with signed cookies, it incorrectly continues to decode a session even if the signature validation fails. Consequently, an attacker who already possesses a valid, encrypted session cookie can simply remove the cookie's now‑invalid signature and continue to use the session data as if it were still legitimate. The attacker does not need the signing secret, encryption key, or the ability to forge session content, and the flaw does not allow the attacker to extend the session expiry or adapt to encryption key rotation. This results in continued access to the original session’s data, potentially persisting until the encryption key is rotated.

The vulnerability affects the @fastify/secure-session plugin version range 7.5.0 through 8.4.1. Applications built on Fastify that rely on this plugin with the signed cookie option are the target for upgrade action.

The CVSS score of 4.2 indicates a moderate severity. The EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is client‑side cookie tampering; an attacker must already possess a valid, unexpired session cookie but requires neither signing secret nor encryption key. While the flaw does not enable arbitrary session forging, it grants continued use of the attacker’s existing session until the encryption key is updated. Given the moderate CVSS and the necessity of a pre‑existing session cookie, the exploitation risk is limited but non‑negligible for systems that rely on signed cookies for session protection.