Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
laminas/laminas-session
2.27.x @ bb86e71
2
Fixes
0
CVEs
MEDIUM
Peak severity
Highlights
Auth Bypass: 1 prior fix. Scrutinize any change in this area.
SessionManager: most-fixed (1 issue). Treat as high-risk during review.
0 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: If headers are already sent, session_destroy() may fail or behave unexpectedly. This prevents proper session termination during logout, leaving the session active and vulnerable to unauthorized reuse.
Session Fixation: Unsuccessful session destruction during key state changes (such as authentication) can allow an attacker to fixate a session ID, as the application fails to invalidate the old session if HTTP headers have already been sent to the client.