Executive brief
Hydro, a platform used for hosting online coding judges and educational content, contains a flaw in how it manages user sessions. When a user logs out or their session is refreshed, the system fails to invalidate the old session token on the server. This allows an attacker who has previously captured a user's session cookie to reuse it to gain unauthorized access to the account, potentially leading to the theft or modification of private data.
Technical details
An insufficient session expiration vulnerability (CWE-613) exists in Hydro's session recreation logic. When a session is renewed or a user logs out, the application generates a new session token but fails to invalidate the previous server-side session entry. An attacker in possession of a stale 'sid' cookie can replay it over the network to maintain access to the victim's account without requiring credentials. This vulnerability is exploitable via the network and requires the attacker to have obtained a previously valid session cookie. The issue has been resolved in version 5.0.2 by ensuring old tokens are deleted before new ones are issued.
Affected products
- Hydro hydrooj >= 4.10.4, <= 5.0.1
Timeline
- 2026-06-17: disclosed: Vulnerability reported/patched by contributor
- 2026-06-18: advisory: GitHub Advisory published