CWE-488: Exposure of Data Element to Wrong Session
The product does not sufficiently enforce boundaries between the states of different sessions, causing data to be provided to, or used by, the wrong session.
A kind of CWE-668 Exposure of Resource to Wrong Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- php frankenphp FrankenPHP before 1.13.4 Cross-Request Response Header Leak in Worker Mode 6.3 Medium
- traefik Traefik before 2.11.60 and 3.7.16 ForwardAuth NTLM/Negotiate Identity Leak 7.0 High
-
libcgi-pm-perlDebian,perl-CGIAzure Linux +1 more CGI::Carp versions before 5.00 for Perl leak warnings across requests in persistent environments via the warningsToBrowser buffer No score - aws strands-agents, strands-agents/sdk +1 more Unintended disclosure of data element to wrong session in Strands Agents SDK A2A Server 8.6 High
- traefik Traefik v3.2.0 before v3.7.14 FastProxy NTLM/Negotiate Connection Pool Identity Leak 7.0 High
- No product listed Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as imposter robots when User-Agent matcher state carries over from a previous request 7.3 High
- apache camel Apache Camel: Camel-AS2 Cross-Partner Signing Key Confusion via Shared Per-Request State 6.5 Medium
- apache camel Apache Camel: Camel-Thrift Cross-Exchange Data Disclosure via a Shared Deserialization Target 5.9 Medium
- curl FTP connection reuse inherits client-certificate 9.1 Critical
- curl local interface connection reuse mixup 8.1 High
- php frankenphp FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared module 7.7 High
- red hat ansible automation platform 2, satellite 6 +1 more Pulp-ansible: bearer tokens are reused across remotes in a worker 6.5 Medium
- red hat ansible automation platform 2, satellite 6, update infrastructure 4 for cloud providers +1 more +3 more Pulp-container: registry credentials are reused across remotes in a worker 6.5 Medium
- apache software foundation apisix Apache APISIX: cross-request permission pollution via static permission list mutation 5.3 Medium
- datadrivenconstruction openconstructionerp datadrivenconstruction OpenConstructionERP Al Provider Configuration ai_client.py wrong session 5.3 Medium
- rclone rclone: FTP cross-session auth-proxy backend confusion 7.3 High
- auth0 react-native-auth0 Improper Cache Isolation in auth0/react-native-auth0 SDK Web Platform Credential Management 6.5 Medium
- jetbrains youtrack In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of... 8.5 High
- ibm contextforge, contextforge mcp gateway - translate utility +1 more IBM ContextForge Translate is affected by cross-client credential context confusion 7.4 High
- curl Negotiate ambient user conn reuse 9.8 Critical
- curl native CA store conn reuse 7.5 High
- ash-project ash graphql Re-entrant synchronous publish in AshGraphql subscription batcher delivers one subscriber's records to another's topic 2.3 Low
- honojs hono Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure 4.8 Medium
- hashicorp tooling consul-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode 10.0 Critical
- hashicorp tooling terraform-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode 10.0 Critical
- github view component view_component: Reused Component Instances Retain Stale Render Context 6.8 Medium
- federatedai fate FederatedAI FATE OSX Broker QueuePushReqStreamObserver.java QueuePushReqStreamObserver.initEggroll wrong session 2.3 Low
- curl wrong reuse for different services 6.5 Medium
- n8n n8n: Merge Node SQL Mode Prototype Pollution 6.0 Medium
- extreme networks platform one ExtremeCloud IQ Cross Tenant Data Exposure via Extreme Platform One Authentication Race Condition 6.3 Medium
- casdoor CVE-2026-9098 9.1 Critical
- microsoft ufo Microsoft UFO shared WebSocket handler state causes cross-client response hijacking 6.3 Medium
- curl wrong reuse of SMB connection 7.5 High
- fleetdm fleet Fleet Vulnerable to Windows MDM cross-device command disclosure 6.6 Medium
- linuxfoundation nats-server NATS is vulnerable to MQTT hijacking via Client ID 6.5 Medium
- zabbix Insufficient isolation of JavaScript (Duktape) execution context on Zabbix Server 7.1 High
- freebsd Jail chroot escape via fd exchange with a different jail 7.5 High
- lettermint, lettermint lettermint-node +1 more Lettermint Node.js SDK leaks email properties to unintended recipients when client instance is reused 4.7 Medium
- whisper.money whisper money, whisper-money +1 more Whisper Money has IDOR Vulnerability on sync/balances endpoint 4.9 Medium
- openproject OpenProject users can delete other user's session, causing them to be logged out 6.5 Medium
- freebsd SO_REUSEPORT_LB breaks connect(2) for UDP sockets 5.4 Medium
- spotipy-dev spotipy Spotipy repo vulnerable to secrets exfiltration via `pull_request_target` 9.1 Critical
- No product listed An issue was discovered in OPC cardsystems Webapp Aufwertung 2.1.0. The reference assigned to... 7.5 High
- cifs-utils cifs.upcall makes an upcall to the wrong namespace in containerized environments 5.9 Medium
- b&r industrial automation gmbh aprol Improper session handling in B&R APROL 5.5 Medium
- element, element-hq element-android +1 more Element Android PIN autologout bypass 5.1 Medium
- red hat build of apache camel 4.8 for quarkus 3.15, build of quarkus 3.15.3.sp1, build of quarkus 3.8.6.sp3 +2 more Io.quarkus:quarkus-rest: quarkus rest endpoint request parameter leakage due to shared instance 8.3 High
- pgadmin Pgadmin: users authenticated simultaneously via ldap may be attached to the wrong session 8.0 High
- aaron13100 404 solution 404 Solution <= 2.35.17 - Missing Authentication to Sensitive Information Exposure 5.3 Medium
- siemens ruggedcom rm1224 lte(4g) eu, ruggedcom rm1224 lte(4g) nam, scalance m804pb +48 more +50 more A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All... 7.3 High
- Show olderLoading…