CVE-2026-79313 Details

A vulnerability in webpy version 0.76 allows for insufficient session expiration, enabling session replay attacks. The issue arises because the framework's session management does not properly check the last-access time of sessions when they are loaded. Instead, it relies on a periodic cleanup process to delete expired sessions. As a result, an attacker with a valid session cookie can access protected resources even after the session has technically expired, exploiting the window before the session record is cleaned up.

As of the report date, no official patch has been released. Users can upgrade to a version that includes the fix once available, or implement a temporary workaround by shortening the session timeout, adding an activity-based check to the authentication logic, and requiring re-authentication for sensitive operations.