A valid admin session cookie remains usable after the user has logged out, allowing an attacker with access to the cookie to continue to perform privileged actions until the cookie naturally expires or the session secrets are changed. The flaw stems from failure to invalidate the session on logout, a weakness classified as CWE‑613. This can lead to unauthorized continued administrative access, data exposure, and potential modification of system settings.

The issue affects the Katalyst Koi framework for Rails admin interfaces. Versions prior to 4.20.0 in the 4.x line and prior to 5.6.0 in the 5.x line are vulnerable. Later releases incorporate the fix that invalidates the session upon logout.

The CVSS score of 7.4 indicates a high severity vulnerability. Because the session cookie can be captured or accessed by an attacker after logout, the attack vector is likely local or remote depending on how the cookie is intercepted; the vulnerability does not require privileged code execution or privilege escalation beyond the initial compromised cookie. EPSS data is not available, and the vulnerability is not listed in the KEV catalog, suggesting the exploitation may not yet be widespread in the wild. However, the impact of allowing continued privileged access remains serious.