A flaw in JetBrains Ktor allows an attacker to forge encrypted session cookies, enabling the forging of a valid user session. The vulnerability permits the impersonation of any authenticated user, potentially granting unauthorized access to protected resources or functions. The weakness is classified under CWE‑354, indicating that the application does not adequately validate or verify encrypted data, leading to session forgery.

JetBrains Ktor web framework versions prior to 3.6.1 are affected. Users running any older release of the Ktor server should consider this a risk until the fix is applied. The fixed version is 3.6.1 and later.

The CVSS score of 8.1 identifies a high‑severity vulnerability. EPSS data is not available, so the exploitation probability is unknown, though the presence of a high CVSS suggests a serious risk. This issue is not currently listed in the CISA KEV catalog. Attackers can likely craft a tampered encrypted cookie and send it to a vulnerable Ktor application over the network, exploiting the flaw remotely without needing local access.