# Ubuntu releases security updates for AWL session key and cookie vulnerabilities

> **Key takeaway:** Two vulnerabilities in AWL allow remote attackers to potentially impersonate users by guessing session keys or cookies.

**Published:** 2026-11-11T18:27:09+00:00 
**Source:** Ubuntu Security & Release Notices 
**Category:** distro-news 
**Canonical URL:** https://fosswire.org/news/ubuntu-releases-security-updates-for-awl-session-key-and-coo.html 

## Summary
Canonical has issued security notice USN-9048-1 to address two distinct vulnerabilities discovered in the AWL software. These flaws impact the way the application handles session security, specifically regarding the generation of cryptographic identifiers.

The vulnerabilities affect users running affected versions of AWL on Ubuntu systems. Remote attackers could exploit these weaknesses to bypass authentication mechanisms and gain unauthorized access to user sessions.

## Vulnerability details for CVE-2020-11728 and CVE-2020-11729
- **Session Key Generation (CVE-2020-11728):** AWL failed to properly generate session keys, which could allow a remote attacker to guess a key and impersonate a legitimate user.
- **Long-term Cookie Security (CVE-2020-11729):** The software did not securely generate long-term session cookies, making them susceptible to brute-force attacks.
- **Authentication Bypass:** Both flaws center on the predictability of session identifiers, which undermines the integrity of the user authentication process.

## Why it matters
This update is critical for Ubuntu users and system administrators relying on AWL for secure session management. Failure to apply these patches leaves services vulnerable to remote session hijacking and unauthorized user impersonation.