Executive brief
Katalyst Koi, a framework for building Ruby on Rails administration interfaces, contains a flaw where administrator session cookies remain valid even after a user logs out. If an attacker manages to obtain a copy of a valid administrator's session cookie—through network interception or access to a shared computer—they can continue to perform administrative actions as that user. This could lead to unauthorized access to sensitive business data or full control over the application's management functions until the session naturally expires.
Technical details
A session management vulnerability (CWE-613) exists in Katalyst Koi due to insufficient session expiration. The application does not invalidate the server-side session or the client-side CookieStore token when an administrator logs out. An attacker who intercepts or otherwise acquires a valid admin session cookie can replay it to the server to gain unauthorized administrative access. The vulnerability is exploited over the network without authentication, though it requires the precondition of obtaining a valid session cookie (reflected in the High Attack Complexity). The fix involves recording the logout timestamp and rejecting any session cookies issued prior to the most recent logout event. Patches are available in versions 4.20.0 and 5.6.0.
Affected products
- Katalyst katalyst-koi < 4.20.0, >= 5.0.0 < 5.6.0
Timeline
- 2026-05-01: disclosed: Initial publication by sfnelson
- 2026-05-07: advisory: GitHub Advisory GHSA-4cx3-3c38-j9vv published
- 2026-05-14: other: NVD published CVE-2026-44511