In affected versions of Octopus Server it was identified that the same encryption process was used for both encrypting session cookies and variables.
octopus octopus server