The flaw lies in the build_secret_key function of dtale's Flask session cookie component. Traditional random generation was used, producing insufficiently random values for the secret key that protects session cookies. As a result, an attacker can more easily guess or forge a valid session cookie. The vulnerability is remote; it does not require local access and can be exploited over the network. The attack complexity is high, but the exploitability is difficult; however, the flaw has been published and may be used by threat actors.

mangroup dtale versions up to and including 3.22.0 are impacted. The vulnerability resides in the dtale/authentication subsystem; any deployment running these versions could be exposed.

With a CVSS score of 6.3, the vulnerability is considered moderately severe. EPSS is not available, and the issue is not in CISA's KEV catalog. The impact rests on the ability to hijack user sessions by predicting the secret key. The vulnerability was released publicly; threat actors could leverage it in a remote exploitation scenario if the application is accessible over the network.