How severe is GHSA-v988-828w-xvf2?

No CVSS score has been assigned to GHSA-v988-828w-xvf2 yet. Review the advisory details and affected package list to assess your exposure.

Which packages are affected by GHSA-v988-828w-xvf2?

GHSA-v988-828w-xvf2 affects the following packages: rucio-webui (PyPI). Ecosystems affected: PyPI.

How do I fix GHSA-v988-828w-xvf2?

Update rucio-webui to 1.26.7 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-v988-828w-xvf2 is resolved across your whole dependency graph.

How do I detect GHSA-v988-828w-xvf2 in my PyPI dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for rucio-webui, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate GHSA-v988-828w-xvf2 if there is no patch (or I can't update yet)?

If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Is GHSA-v988-828w-xvf2 actively exploited in the wild?

No public exploit code has been indexed for GHSA-v988-828w-xvf2 yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

When was GHSA-v988-828w-xvf2 published, and has it been updated?

GHSA-v988-828w-xvf2 was published on October 22, 2021 and was last updated on February 13, 2025. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

🐍 PyPI

Not in CISA KEV

Authentication Bypass Using an Alternate Path or Channel and Authentication Bypass by Primary Weakness in rucio-webuiGHSA-v988-828w-xvf2

Fix: rucio/rucio@8f83240

GHSA-v988-828w-xvf2 is a security vulnerability in rucio-webui. A fix is available for rucio-webui — see the affected versions and patch details below.

Published

Oct 22, 2021

Updated

Feb 13, 2025

Affected

1 pkg

Patched

1 / 1

Exploits

None indexed

Exploitation data as of Feb 13, 2025 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected

🐍rucio-webui

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.

Description

Impact

rucio-webui installations of the 1.26 release line potentially leak the contents of cookies to other sessions within a wsgi container. Impact is that Rucio authentication tokens are leaked to other users accessing the webui within a close timeframe, thus allowing users to access the webui with the leaked authentication token. Privileges are therefore also escalated.

Rucio server / daemons are not affected by this issue, it is isolated to the webui.

Patches

This issue is fixed in the 1.26.7 release of the rucio-webui.

Workarounds

Installation of the 1.25.7 webui release. The 1.25 and previous webui release lines are not affected by this issue.

References

https://github.com/rucio/rucio/issues/4928

Affected Packages

1 total 1 fixed

Ecosystem	Package	Vulnerable range	Fix
🐍PyPI	`rucio-webui`	≥ 1.26.0&&< 1.26.7	1.26.7`pip install --upgrade 'rucio-webui==1.26.7'`

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for rucio-webui, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update rucio-webui to 1.26.7 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-v988-828w-xvf2 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Frequently Asked Questions

### Impact `rucio-webui` installations of the `1.26` release line potentially leak the contents of cookies to other sessions within a wsgi container. Impact is that Rucio authentication tokens are leaked to other users accessing the `webui` within a close timeframe, thus allowing users to access the `webui` with the leaked authentication token. Privileges are therefore also escalated. Rucio server / daemons are not affected by this issue, it is isolated to the webui. ### Patches This issue is fixed in the `1.26.7` release of the `rucio-webui`. ### Workarounds Installation of the `1.25.7` `w

O3 Security · Impact-Aware SCA

Is GHSA-v988-828w-xvf2 in your dependencies?

Find it across PyPI, including transitive dependencies.

Scan my dependencies How O3 SCA works