The vulnerability stems from web.py’s session handling, which depends on a periodic cleanup to expire sessions rather than verifying the last‑access time when a session is loaded. Consequently, an expired session whose record has not yet been removed can still be replayed. An attacker who has obtained a previously valid session cookie can continue to access protected resources after the configured idle timeout. Based on the description, the likely attack vector is the replay of a stolen session cookie, though no explicit exploit details are provided.

web.py 0.76 – the webpy Python framework. No other versions or products are listed as affected in the advisory.

The CVSS score is not provided, and the EPSS score is unavailable, indicating no quantifiable assessment of the probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. While the risk of unauthorized access exists for deployments still using web.py 0.76, there are no public exploits documented. The likelihood remains uncertain but potentially significant for applications that have not updated their session handling logic or scheduled cleanup runs.