CVE-2025-64168CWE-362CWE-668

CVE-2025-64168

High · published October 31, 2025

CVSS v3.1
7.1
EPSS
0%
Percentile
4.9
In the wild
Unconfirmed
What it is

⚡ A sneaky race condition in Agno could expose user data from one session to another! 🚨 Think of it like a busy restaurant where a server accidentally gives your meal to the wrong table because they didn’t check the order carefully — the next diner gets a taste of your dish when they should have their own! This flaw could allow user data to leak, meaning sensitive information might be revealed to the wrong person. Imagine someone getting access to your private conversations or account details just because of a mix-up during a busy moment! That's a recipe for chaos!

Put simply

Think of it like a busy restaurant where a server accidentally gives your meal to the wrong table because they didn’t check the order carefully — the next diner gets a taste of your dish when they should have their own! The vulnerability occurs when session_state is mishandled during high concurrency due to a race condition in the Agno framework, leading to incorrect data being assigned to user sessions.

What to do

This flaw could allow user data to leak, meaning sensitive information might be revealed to the wrong person. Imagine someone getting access to your private conversations or account details just because of a mix-up during a busy moment! That's a recipe for chaos! To secure your environment, upgrade Agno to version 2.2.2 immediately. Also, monitor your session management practices to ensure that similar race conditions don't arise in other areas. You've got this! By taking these steps, you'll be a security hero in no time! 🛡️

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00161 · 4.9th percentile
Weaknesses
CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'); CWE-668 · Exposure of Resource to Wrong Sphere
Published
2025-10-31T19:15Z
References (1)
EPSS history
Timeline
  • 31 OCT 14:58Z
    Agno session state overwrites between different sessions/users
    cvelistv5