The vulnerability stems from web.py’s session handling, which depends on a periodic cleanup to expire sessions instead of verifying the last‑access time when a session is loaded. Consequently, an expired session whose record has not yet been removed can still be replayed. An attacker who has obtained a previously valid session cookie can continue to access protected resources after the configured idle timeout. The primary impact is that a user’s identity can be hijacked once their session cookie has expired but not yet purged.

web.py 0.76 – the webpy Python framework. No other versions or products are listed as affected in the advisory.

The CVSS score is 9.8, and the EPSS score is not available, indicating no quantifiable assessment of the probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. While the risk of unauthorized access exists for deployments still using web.py 0.76, there are no public exploits documented. The likelihood remains uncertain but potentially significant for applications that have not updated their session handling logic or scheduled cleanup runs.