CVE-2026-123317

HighCVSS 8.1/10Last modified Nov 7, 2026

Description

In JetBrains Ktor before 3.6.1 session forgery was possible via tampered encrypted session cookies

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-354

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 6, 2026
Last modified
Nov 7, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1233184.8In JetBrains Ktor before 3.6.1 hTTP request smuggling was possible in the CIO engineCVE-2026-1233193.7In JetBrains Ktor before 3.6.1 missing Domain attribute validation in client cookie storage allowed cookie injectionCVE-2026-1233203.1In JetBrains Toolbox App before 3.9 insufficient warning in the login dialog allowed connecting to a malicious serverCVE-2026-1233217.8In JetBrains WebStorm before 2026.3, 2026.2.3 code execution via Grunt and Gulp task loading was possible in untrusted projectsCVE-2026-1233226.3In JetBrains WebStorm before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Angular CLI schematics loaderCVE-2026-1233238.4In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 improper URL validation in the app widget host allowed apps to sendCVE-2026-1233247.7In JetBrains YouTrack before 2026.2.19562 information disclosure via shared mailbox message history was possibleCVE-2026-1233257.1In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 inclusion of untrusted remote code was possible via the plugin sandCVE-2026-1233267.1In JetBrains YouTrack before 2026.2.19197 incorrect authorisation in the scripts debugger allowed workflow script disclosure and suspensionCVE-2026-1233277.5In JetBrains YouTrack before 2026.2.19562 missing authorization in the saved query endpoint allowed disclosure of issue descriptionsCVE-2026-1233286.4In JetBrains YouTrack before 2026.2.19656 app permission bypass allowed privilege escalation via project tabCVE-2026-1233295.4In JetBrains YouTrack before 2026.2.19562 missing authorization in TeamCity integration allowed disclosure of other projects' actions
CVE-2026-123317: High severity, CVSS 8.1 | Vulnix