CWE-384: Session Fixation
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
A kind of CWE-1462 Improper Session Management.
From the CWE List. © The MITRE Corporation.
Newest
- itel idenc firmwareThe Itel DAB Encoder (IDEnc build 25aec8d) is vulnerable to Authentication Bypass due to improper...10.0 Critical
- hewlett packard enterprise (hpe) hpe aruba networking aos-cx, hpe arubaos-cx +1 moreAuthenticated Session Hijacking Allows Unauthorized Access in Network Switching Software5.8 Medium
- itel idgateway firmwareThe Itel DAB Gateway (IDGat build c041640a) is vulnerable to Authentication Bypass due to...10.0 Critical
- ckanCKAN Vulnerable to Session Cookie Fixation6.1 Medium
- keycloak, red hat build of keycloak 26.2, build of keycloak 26.2.11 +2 more +4 moreOrg.keycloak.protocol.oidc.endpoints.logoutendpoint: offline session takeover due to reused authentication session id6.0 Medium
- creativeitem academy lmsCreativeitem Academy LMS up to and including 5.13 does not regenerate session IDs upon successful...2.2 Low
- rolantis information technologies agentisSession Hijacking in Rolantis Information Technologies' Agentis8.8 High
- flagforgeFlagForgeCTF's Improper Session Handling Allows Access After Logout9.8 Critical
- yandaozi ppressAn issue was discovered in PPress 0.0.9 allowing attackers to gain escilated privlidges via...8.0 High
- payload cms payloadUser Session Fixation after Account Removal in PayloadCMS5.3 Medium
- apache tomcatApache Tomcat: session fixation via rewrite valve6.5 Medium
- givanz vvvebgivanz Vvveb session fixiation5.3 Medium
- discourseDiscourse's WebAuthn challenge isn't cleared from user session after authentication8.2 High
- hcl software iem, hcltech intelliops event management +1 moreHCL IEM is affected by a cookie attribute not set vulnerability2.0 Low
- hcl software iem, hcltech intelliops event management +1 moreHCL IEM is affected by a concurrent login vulnerability2.6 Low
- ibm db2 mirror for iIBM Db2 Mirror for i session fixation6.3 Medium
- ollamaOllama vulnerable to Cross-Domain Token Exposure6.9 Medium
- alcatel-lucent omniaccess stellar productsWeak Session ID Check in the OmniAccess Stellar Web Management Interface9.8 Critical
- filebrowserFileBrowser Has Insecure JWT Handling Which Allows Session Replay Attacks after Logout7.7 High
- zitadelZITADEL has broken authN and authZ in session API and resulting session tokens7.7 High
- moodleMoodle Session Fixation allows unauthenticated users to hijack sessions via sesskey parameter4.2 Medium
- abb eibport v3 knx, eibport v3 knx gsm +1 moreession-Management Failure9.4 Critical
- zitadelZITADEL Allows IdP Intent Token Reuse8.0 High
- phpgurukul hostel management systemA vulnerability was found in PHPGurukul Hostel Management System 2.1 in the /hostel/change...9.1 Critical
- phpgurukul user registration \& login and user management systemA critical vulnerability was found in PHPGurukul User Registration & Login and User Management...9.8 Critical
- meon kyc solutionsImproper Authentication Vulnerability in Meon KYC solutions8.2 High
- No product listedImproper session management in the /login_ok.htm endpoint of DAEnetIP4 METO v1.25 allows...9.8 Critical
- No product listedImproper session management in Elber REBLE310 Firmware v5.5.1.R , Equipment Model: REBLE310/RX10...9.8 Critical
- softcom iksorisXSS in iKSORIS2.3 Low
- palo alto networks cloud ngfw, pan-os, prisma access +2 morePAN-OS: Session Fixation Vulnerability in GlobalProtect SAML Login8.3 High
- goauthentik authentikauthentik's deletion of sessions did not revoke sessions when using database session storage8.0 High
- sap se business one (service layer)Broken Authentication in SAP Business One (Service Layer)6.8 Medium
- printerlogic vasion print, virtual appliance +1 moreVasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923...9.1 Critical
- mattermost, mattermost server +1 moreSession Persistence After User-to-Bot Conversion3.1 Low
- ibm openpages with watsonIBM OpenPages session fixation4.3 Medium
- prasathmani tiny file managerTiny File Manager v2.4.7 and below is vulnerable to session fixation.9.8 Critical
- hcl software iautomate, hcltech dryice iautomate +1 moreHCL iAutomate is affected by a session fixation vulnerability5.5 Medium
- cloud foundry uaaCVE-2025-22216 UAA Missing Zone Validation5.4 Medium
- broadcom symantec privileged access managementA malicious actor can fix the session of a PAM user by tricking the user to click on a specially...9.3 Critical
- broadcom symantec privileged access managementAn improper session validation allows an unauthenticated attacker to cause certain request...5.3 Medium
- No product listedMailcow through 2024-11b has a session fixation vulnerability in the web panel. It allows remote...7.1 High
- youdiancmsAn issue in youdiancms v.9.5.20 and before allows a remote attacker to escalate privileges via...9.8 Critical
- hcl software dryice myxalyticsHCL MyXalytics is affected by insufficient session expiration6.4 Medium
- hcl software dryice myxalyticsHCL MyXalytics is affected by a session fixation vulnerability6.8 Medium
- pglombardo passwordpusherPassword Pusher Allows Session Token Interception Leading to Potential Hijacking5.7 Medium
- image access gmbh scan2netBroken Access Control5.5 Medium
- glpi-project glpiGLPI vulnerable to unauthenticated session hijacking9.3 Critical
- abb matrix series, nexus series, aspect-ent-12 firmware +20 more +22 morePHP Session Fixation9.3 Critical
- chatwoot, chatwoot chatwoot/chatwoot +1 moreSession Fixation in chatwoot/chatwoot6.8 Medium
- jenkins openid, openid connect authentication, jenkins project openid connect authentication plugin +2 moreSession fixation vulnerability in Jenkins OpenId Connect Authentication Plugin8.8 High
- Show moreLoading…