Executive brief
DT ale is a Python web application framework used for data analysis and visualization. A vulnerability in the session cookie secret key generation uses weak randomness, allowing attackers to forge session cookies and bypass authentication when enabled. This could lead to unauthorized access to sensitive data and analytics features.
Technical details
The vulnerability stems from use of a non-cryptographic Mersenne Twister PRNG (via numpy.random) to generate Flask's SECRET_KEY in the build_secret_key() function of dtale/app.py. The generated key uses only 10 characters from a 36-character alphabet (36^10 ≈ 2^51.7 bits entropy), insufficient for cryptographic signing. Since Flask uses SECRET_KEY to HMAC-sign session cookies, an attacker can predict or brute-force valid session tokens offline to forge authenticated sessions when authentication is enabled. The attack requires network access but has high complexity; exploitation is difficult but feasible. The fix replaces the weak RNG with secrets.token_urlsafe(32), providing 256 bits of cryptographic entropy. A pull request with the fix awaits acceptance.
Affected products
- Man Group DT ale up to 3.22.0
Timeline
- 2026-08-15: disclosed
- 2026-07-02: other: Patch pull request #963 submitted