CWE-384: Session Fixation
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
A kind of CWE-1462 Improper Session Management.
From the CWE List. © The MITRE Corporation.
Newest
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 more Keycloak-services: keycloak-services: oidc logout endpoint session fixation via id_token_hint leading to account takeover 6.4 Medium
- mathurvishal cloudclassroom-php-project mathurvishal CloudClassroom-PHP-Project loginlinkadmin.php session_regenerate_id session fixiation 5.3 Medium
- apache software foundation wicket Apache Wicket: The session id is renewed only on the first sign in, not on re-authentication 7.2 High
- jenkins Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic... 8.1 High
- python-social-auth social-core Python Social Auth: OpenID Connect nonce is not bound to the browser session, so a stolen authorization code logs the attacker in as the victim 6.8 Medium
- tinyhumansai openhuman OpenHuman /auth/telegram CSRF allows attacker-controlled session implantation 8.1 High
- labredescefetrj wegia WeGIA: Session Fixation via User-Controlled PHPSESSID Cookie + DB_HOST Leak in html/seguranca/sessionStart.php 8.1 High
- videowhisper broadcast live video WordPress Broadcast Live Video plugin <= 7.3.2 - Session Hijacking vulnerability 7.3 High
- ibm websphere application server - liberty, websphere application server +1 more IBM WebSphere Application Server Liberty is affected by an authentication bypass 9.1 Critical
- omnispace agora project Omnispace Agora Project < 26.10.0 Session Fixation via Authentication 8.6 High
- No product listed An issue in ProPhoenix Law RMS v2022.2403.3.101 allows attackers to execute a session hijacking... 9.1 Critical
- asynchttpclient async-http-client AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS 6.8 Medium
- asynchttpclient async-http-client AsyncHttpClient: Incomplete origin checks in the default cookie store allow cookie tossing onto public-suffix and IP-address hosts 4.0 Medium
- apache jackrabbit Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens 9.3 Critical
- kishor-23 food-waste-management-system kishor-23 food-waste-management-system Login Flow login.php session fixiation 5.3 Medium
- yeswiki YesWiki before 4.6.7 Session Fixation via Login in AuthController.php 7.6 High
- zammad Undisclosed RCE in Zammad v6.3 and higher 8.7 High
- shopify tophat, toptech systems tms7 +1 more Toptech TMS7 and TopHAT Session Fixation 7.5 High
- pretix Customer session fixation 1.7 Low
- apache qpid broker-j Apache Qpid Broker-J: Missing HTTP-session renewal after successful authentication 9.8 Critical
- python-social-auth social-core social-auth-core has a Session Fixation issue 4.2 Medium
- mstfakts college-management-system Mstfakts College-Management-System Authentication server.php session_start session fixiation 5.3 Medium
-
webpyDebian webpy web.py 0.76 is vulnerable to Session Fixation. The component Session._load() reads... 6.8 Medium - hatchet-dev hatchet hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState 7.1 High
- apache airflow Apache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixation 4.2 Medium
- syslifters sysreptor SysReptor: Session Fixation in Password-Protected Shared Notes 3.7 Low
- team-alembic ash authentication Session id is not renewed on authentication in ash_authentication, allowing session fixation 7.4 High
- opencast Opencast: Session fixation in login enables account takeover via crafted link 8.8 High
- hubzero hubzero-cms HUBzero CMS through 2.2.32 Session Fixation via Query-String Session Identifier 8.5 High
- suse neuvector Flaw in Neuvector can result in one user receiving another user's authenticated session when multiple SSO login attempts occur concurrently 8.8 High
- djust-org djust djust: SSE sessions are not bound to the authenticated user; the client-chosen session_id is the sole authorization capability (session hijack) 7.4 High
- http4s Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain 6.8 Medium
- secomea gatemanager Session Fixation 8.3 High
- tirrenotechnologies tirreno tirreno has Session Fixation in Login Authentication 5.3 Medium
- itsourcecode student management system ningzichun Student Management System login.php session_start session fixiation 5.3 Medium
- adobe photoshop mobile, photoshop android +1 more Photoshop Mobile | Session Fixation (CWE-384) 7.4 High
- sourcecodester syllabus-aligned learning management & examination system SourceCodester Syllabus-Aligned Learning Management & Examination System Login auth_process.php session fixiation 5.3 Medium
- No product listed An issue in HubCore v.14.1.1 allows a remote attacker to escalate privileges via the HUBCOREID... 9.8 Critical
- misp Session Fixation in MISP CustomAuth Authentication Allows Session Hijacking 7.6 High
- jenkins In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a... 7.3 High
- ibm administration runtime expert for i IBM Application Runtime Expert (ARE) for IBM i is vulnerable to a user gaining elevated privileges and sensitive information [, ]. 9.9 Critical
- flowintel Flowintel Fails to Invalidate Active Sessions After Password Change 9.1 Critical
- tryghost ghost Ghost: Session Fixation in Ghost Admin 6.7 Medium
- guzzle Guzzle: Noncanonical cookie domain keeps subdomain scope 6.5 Medium
- hashicorp tooling terraform-mcp-server vulnerable to cross-user credential inheritance if an MCP session ID is obtained by another user 8.9 High
- quest kace systems management appliance An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. Certain API... 9.8 Critical
- redhat build of keycloak, red hat build of keycloak 26.6, build of keycloak 26.6.7 +3 more +5 more Keycloak-services: keycloak-services: authorization codes can be retargeted to another client session 5.4 Medium
- guzzle Guzzle: Cookie Disclosure and Injection via IP-Address Domains 4.7 Medium
- sourcecodester cet automated grading system with ai predictive analytics SourceCodester CET Automated Grading System with AI Predictive Analytics session fixiation 6.3 Medium
- surrealdb SurrealDB before 3.1.0 Session Hijacking via /rpc sessions 8.7 High
- Show olderLoading…