OctoPrint vulnerable to Insufficient Session Expiration.

MEDIUM 4.4CVE-2022-2888 · GHSA-937f-qh3w-6g87 · PYSEC-2022-282 · Published 21/09/2022 · updated 17/06/2026

In short

CVE-2022-2888 is a MEDIUM (CVSS 4.4) vulnerability affecting octoprint, octoprint (octoprint).
Chance of exploitation in the next 30 days (EPSS): 0.30%, higher than 22.5% of all vulnerabilities.
Fix: update to 1.8.3 or later.

Package	Affected versions	Patched versions
octoprint PyPI	`< 1.8.3`	`1.8.3`
octoprint octoprint	`< 1.8.3`	`1.8.3`

Description

If an attacker comes into the possession of a victim's OctoPrint session cookie through whatever means, the attacker can use this cookie to authenticate as long as the victim's account exists. This issue is fixed in version 1.8.3.

NVD description

If an attacker comes into the possession of a victim's OctoPrint session cookie through whatever means, the attacker can use this cookie to authenticate as long as the victim's account exists.

References

nvd.nist.gov/vuln/detail/CVE-2022-2888 · ADVISORY
octoprint/octoprint commit 40e6217 · WEB
octoprint/octoprint · PACKAGE
pypa/advisory-database · WEB
huntr.dev/bounties/d27d232b-2578-4b32-b3b4-74aabdadf629 · WEB
GitHub Advisory GHSA-937f-qh3w-6g87 · ADVISORY

More vulnerabilities in octoprint

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

octoprint

PyPI

< 1.8.3

1.8.3

octoprint

< 1.8.3

1.8.3

Description

NVD description

If an attacker comes into the possession of a victim's OctoPrint session cookie through whatever means, the attacker can use this cookie to authenticate as long as the victim's account exists.

More vulnerabilities in octoprint

See all →