Manyfold is an open‑source web application for managing 3D models. Versions prior to 0.133.0 allow an attacker to hijack a user session because authentication cookies are written to proxy cache entries that are shared among clients. The vulnerability is a session cookie leakage problem, classified as CWE‑613, enabling an attacker to impersonate an authenticated user and gain unauthorized access to the application and potentially its underlying data.

The affected product is Manyfold 3D, the self‑hosted web application from manyfold3d. All releases earlier than 0.133.0 are vulnerable; the fix was released in version 0.133.0. Users running any of these prior versions are susceptible. No other vendor or product is listed.

The CVSS score of 6.8 indicates moderate severity, but the EPSS score of less than 1% suggests that real‑world exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog, highlighting its low exploitation footprint. An attacker would need to send or intercept responses through a shared proxy cache that stores session cookies, or target a tenant in a multitenant environment exposed behind such a cache. If successful, the attacker could impersonate a legitimate user and access sensitive data or perform actions on behalf of that user.