{"id":"CVE-2021-3311","aliases":["GHSA-7ggw-h8pp-r95r"],"url":"https://o3.security/vulnerability/CVE-2021-3311","summary":"October CMS Session ID not invalidated after logout","details":"### Impact\nWhen logging out, the session ID was not invalidated. This is not a problem while the user is logged out, but as soon as the user logs back in the old session ID would be valid again; which means that anyone that gained access to the old session cookie would be able to act as the logged in user. This is not a major concern for the majority of cases, since it requires a malicious party gaining access to the session cookie in the first place, but nevertheless has been fixed.\n\n### Patches\nIssue has been patched in Build 472 (v1.0.472) and v1.1.2.\n\n### Workarounds\nApply https://github.com/octobercms/library/commit/642f597489e6f644d4bd9a0c267e864cabead024 to your installation manually if unable to upgrade to Build 472 or v1.1.2.\n\n### References\n- Reported by Anisio (Brazilian Information Security Analyst)\n- http://cve.circl.lu/cve/CVE-2021-3311\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Email us at [hello@octobercms.com](mailto:hello@octobercms.com)\n\n### Threat assessment:\n<img width=\"699\" alt=\"Screen Shot 2021-02-07 at 11 50 35 PM\" src=\"https://user-images.githubusercontent.com/7253840/107180881-51eaf000-699f-11eb-8828-333128faf2a6.png\">","published":"2021-02-05T14:15:19.153Z","modified":"2026-10-24T10:50:41.748924368Z","cvss":{"score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"Packagist","name":"october/rain","fixedVersion":"1.0.472"},{"ecosystem":"Packagist","name":"october/rain","fixedVersion":"1.1.2"}],"fix":{"url":"https://github.com/octobercms/library/commit/642f597489e6f644d4bd9a0c267e864cabead024","label":"octobercms/library@642f597"},"references":[{"type":"ADVISORY","url":"https://octobercms.com/forum/chan/announcements"},{"type":"FIX","url":"https://github.com/octobercms/library/commit/642f597489e6f644d4bd9a0c267e864cabead024"},{"type":"EVIDENCE","url":"https://anisiosantos.me/october-cms-token-reactivation"},{"type":"WEB","url":"https://github.com/octobercms/october/security/advisories/GHSA-7ggw-h8pp-r95r"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3311"},{"type":"WEB","url":"https://packagist.org/packages/october/rain"},{"type":"WEB","url":"http://cve.circl.lu/cve/CVE-2021-3311"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-24T10:50:41.748924368Z"}}