aio-libs aiohttp-session version 2.6.0 and earlier contains a Other/Unknown vulnerability in EncryptedCookieStorage and NaClCookieStorage that can result in Non-expiring sessions / Infinite lifespan. This attack appear to be exploitable via Recreation of a cookie post-expiry with the same value.
{ "nvd_published_at": null, "cwe_ids": [ "CWE-613" ], "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2020-06-16T21:47:02Z" }