github_osv/GHSA-c7q8-m4xw-c674
Hybridsessions does not expire session id on logout
When using the hybridsessions module is used without the session-manager module installed and sessions IDs are saved to disk, unexpired SessionIDs of logged out users can still be used to make authenticated requests.
gitlab/packagist/silverstripe/hybridsessions/CVE-2022-24444
Hybridsessions does not expire session id on logout
Silverstripe silverstripe/framework through 4.10 allows Session Fixation.