CVE-2026-92984

HUBzero CMS through 2.2.32 Session Fixation via Query-String Session Identifier

8.5 High

HUBzero CMS through 2.2.32 accepts session identifiers from query strings and request variables instead of cookies alone, allowing unauthenticated attackers to fixate victim sessions. Attackers can obtain a valid session identifier, send victims a crafted link containing it, and replay the identifier after the victim authenticates to hijack their account and access.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Active

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: None

Exploit likelihood

0.46%Up 0.2 points since Sep 18, 2026

What each source reports

CVE List Score used 8.5

HUBzero CMS through 2.2.32 Session Fixation via Query-String Session Identifier

Record: CVE-2026-92984
CVSS 4.0: 8.5 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Weakness: CWE-384
Updated: 2026-11-02

EUVDEUVD-2026-81621 8.5

Record: EUVD-2026-81621
CVSS 4.0: 8.5 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-jq63-mx4g-ww7g 8.5

HUBzero CMS through 2.2.32 accepts session identifiers from query strings and request variables...

Record: GHSA-jq63-mx4g-ww7g
CVSS 4.0: 8.5 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Weakness: CWE-384
Updated: 2026-11-02

NVD 8.5

Record: CVE-2026-92984
CVSS 4.0: 8.5 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Weakness: CWE-384
Updated: 2026-11-02

OSV 8.5

HUBzero CMS through 2.2.32 Session Fixation via Query-String Session Identifier

Record: CVE-2026-92984
CVSS 4.0: 8.5 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Weakness: CWE-384
Updated: 2026-11-02

Affected products

hubzero hubzero-cms

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-92984 is a high vulnerability (CVSS 8.5) in Hubzero Hubzero-cms, published September 17, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.46%, the 40th percentile. No source names a fixed version.