NiceGUI Authentication Vulnerability Allowing Session Hijacking Across Browsers

A vulnerability in NiceGUI versions prior to 2.9.1 allows for session hijacking across different browsers, including incognito mode. When a user logs in on one browser, the session is shared with all other browsers without requiring a password. This issue has been addressed in NiceGUI version 2.9.1.

Impact

Exploitation of this vulnerability allows for unauthorized access to user sessions across different browsers, potentially leading to unauthorized actions being performed on behalf of the user.

Reproduction

To reproduce this vulnerability, log into NiceGUI using a standard browser. After logging in, open a new browser or an incognito window. The session will be active without requiring a password, indicating that the authentication has been shared across browsers.

Remediation

Users can upgrade to NiceGUI version 2.9.1 or later to address this vulnerability.