PyPI: zenml

CVE-2024-4680

Safety vulnerability ID: SFTY-20240608-93701

Safety legacy ID: pyup.io-71914

Affected versions of zenml-io/zenml allow attackers to reuse old session credentials or session IDs due to insufficient session expiration. Specifically, the session does not expire after a password change, enabling an attacker to maintain access to a compromised account without the victim's ability to revoke this access. This issue was observed in a self-hosted ZenML deployment via Docker, where after changing the password from one browser, the session remained active and usable in another browser without requiring re-authentication.

PythonPyPINVDNVDGitHubGHSA
Created at: Jul 5, 2026Updated at: Jul 5, 2026

Overview

zenml-io/zenml does not expire the session after password reset

Advisory

Affected versions of zenml-io/zenml allow attackers to reuse old session credentials or session IDs due to insufficient session expiration. Specifically, the session does not expire after a password change, enabling an attacker to maintain access to a compromised account without the victim's ability to revoke this access. This issue was observed in a self-hosted ZenML deployment via Docker, where after changing the password from one browser, the session remained active and usable in another browser without requiring re-authentication.

Affected Package

Affecting zenml package, versions<0.56.3

Also affects

---

How to Fix

Upgradezenmlto0.56.3or higher.

Mitigation and Workarounds

---

Vulnerable Functions

Functions linked to known vulnerabilities.

Vulnerable function data is available for Enterprise customers

Book a call with us to see Safety in action.

References

Safety

Verified by Safety

Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.

Learn more