Mealie1.0.0beta3 does not terminate download tokens after a user logs out, allowing attackers to perform a man-in-the-middle attack via a crafted GET request.
According to WASC, “Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization.”
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Mealie | Mealie | 0.5.5 (including) | 0.5.5 (including) |
| Mealie | Mealie | 1.0.0-beta3 (including) | 1.0.0-beta3 (including) |