Weakness (CWE)
CWE-384: Session Fixation
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
More detail
Such a scenario is commonly observed when:
- A web application authenticates a user without first invalidating the existing session, thereby continuing to use the session already associated with the user.
- An attacker is able to force a known session identifier on a user so that, once the user authenticates, the attacker has access to the authenticated session.
- The application or container uses predictable session identifiers.
In the generic exploit of session fixation vulnerabilities, an attacker creates a new session on a web application and records the associated session identifier. The attacker then causes the victim to associate, and possibly authenticate, against the server using that session identifier, giving the attacker access to the user's account through the active session.
How to prevent it (3 mitigations)
-
Architecture and Design
Invalidate any existing session identifiers prior to authorizing a new user session.
-
Architecture and Design
For platforms such as ASP that do not generate new values for sessionid cookies, utilize a secondary cookie. In this approach, set a secondary cookie on the user's browser to a random value and set a session variable to the same value. If the session variable and the cookie value ever don't match, invalidate the session, and force the user to log on again.
-
Operation
Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth [REF-1481].
Source: MITRE CWE-384
51 results · Clear filters · Feed
-
Critical 9.4
Session fixation in the CLI login flow allows an unauthenticated attacker to obtain a user's API token
Session Fixation vulnerability in the CLI login flow in nerves-hub nerves_hub_web allows an unauthenticated attacker to obtain an API token for another user's account via a crafted login link. Starting a CLI login with POST /api/auth/cli_session needs no auth…
-
Critical 9.1
IBM WebSphere Application Server Liberty is affected by an authentication bypass
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature is enabled.
-
Critical 9.1
An issue in ProPhoenix Law RMS v2022.2403.3.101 allows attackers to execute a session hijacking attack via injecting a …
-
Critical 9.3CVE-2026-92414 Public exploit
Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens
: Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with no credential check. This issu…
-
Critical 9.4
Undisclosed RCE in Zammad v6.3 and higher
Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework.
KEV Oct 2, 2026 -
Critical 9.8
Apache Qpid Broker-J: Missing HTTP-session renewal after successful authentication
Session fixation in HTTP management authentication allows remote attackers to gain unauthorized access to an authenticated management session via reuse of a session identifier retained across successful authentication. This issue affects Apache Qpid Broker-J:…
-
Critical 9.8
An issue in HubCore v.14.1.1 allows a remote attacker to escalate privileges via the HUBCOREID session cookie handling …
-
Critical 9.9
IBM Application Runtime Expert (ARE) for IBM i is vulnerable to a user gaining elevated privileges and sensitive information [, ].
IBM Administration Runtime Expert for i 1R1M0 IBM Application Runtime Expert (ARE) for i could allow a remote attacker to gain elevated privileges, caused by ARE GUI component processing. An unauthenticated attacker can exploit this vulnerability to execute a…
-
Critical 9.1
Flowintel Fails to Invalidate Active Sessions After Password Change
Affected versions of Flowintel do not revoke existing authenticated sessions when a user’s password is changed. This means that if an attacker already possesses a valid session—for example, from prior access or a stolen session token—the victim changing their…
-
Critical 9.8
An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. Certain API endpoints contain a rate…
-
Critical 9.3
MISP AAD authentication plugin - Improper OAuth State Handling, Missing Session Rotation, Insecure Redirect URI Validation, and Log Injection
The Azure Active Directory (AAD) authentication implementation contained multiple weaknesses in its OAuth 2.0 authorization flow that could allow attackers to bypass important security guarantees provided by the protocol. The application used the PHP session …
-
Critical 9.1
Catalyst::Plugin::Authentication versions before 0.10_027 for Perl is susceptible to session fixation attacks
Catalyst::Plugin::Authentication versions before 0.10_027 for Perl is susceptible to session fixation attacks. Catalyst::Plugin::Authentication does not automatically change the session id after authentication. An attacker that obtains a session id cookie can…
-
Critical 9.8
Improper Authentication (Authentication Bypass) exists in Neterbit NW-431F Router 20241014-IR03 and before. The router …
-
Critical 9.1
Apache Wicket: possible session fixation using AuthenticatedWebSession
Missing invocation of Servlet http web request method changeSessionId after session binding can be exploited for a session fixation attack in Apache Wicket. This issue affects Apache Wicket: from 8.0.0 through 8.17.0, 9.0.0, from 10.0.0 through 10.8.0. Users …
-
Critical 9.6
OpenBao lacks user confirmation for OIDC direct callback mode
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao does not prompt for user confirmation when logging in via JWT/OIDC and a role with `callback_mode` set to `direct`. This allows an attacker to start an authent…
-
Critical 9.1
A session fixation vulnerability exists in 66biolinks v62.0.0 by AltumCode, where the application does not regenerate t…
-
Critical 10.0
The Itel DAB Encoder (IDEnc build 25aec8d) is vulnerable to Authentication Bypass due to improper JWT validation across…
-
Critical 10.0
The Itel DAB Gateway (IDGat build c041640a) is vulnerable to Authentication Bypass due to improper JWT validation acros…
-
Critical 9.8
FlagForgeCTF's Improper Session Handling Allows Access After Logout
Flag Forge is a Capture The Flag (CTF) platform. In versions from 2.2.0 to before 2.3.1, the FlagForge web application improperly handles session invalidation. Authenticated users can continue to access protected endpoints, such as /api/profile, even after lo…
-
Critical 9.8
Weak Session ID Check in the OmniAccess Stellar Web Management Interface
Successful exploitation of the vulnerability could allow an unauthenticated attacker to obtain a valid session ID with administrator privileges by spoofing the login request, potentially allowing the attacker to modify the behaviour of the access point.
-
Critical 9.8
A critical vulnerability was found in PHPGurukul User Registration & Login and User Management System V3.3 in the /logi…
-
Critical 9.1
A vulnerability was found in PHPGurukul Hostel Management System 2.1 in the /hostel/change-password.php file of the use…
-
Critical 9.8
Improper session management in Elber REBLE310 Firmware v5.5.1.R , Equipment Model: REBLE310/RX10/4ASI allows attackers …
-
Critical 9.8CVE-2025-28242 Scanner template
Improper session management in the /login_ok.htm endpoint of DAEnetIP4 METO v1.25 allows attackers to execute a session…
-
Critical 9.1
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Session Fixati…
-
Critical 9.8CVE-2022-40916 Public exploit
Tiny File Manager v2.4.7 and below is vulnerable to session fixation.
-
Critical 9.3
A malicious actor can fix the session of a PAM user by tricking the user to click on a specially crafted link to the PA…
-
Critical 9.8
An issue in youdiancms v.9.5.20 and before allows a remote attacker to escalate privileges via the sessionID parameter …
-
Critical 9.8
Two-factor Authentication (TFA) - Critical - Access bypass - SA-CONTRIB-2024-043
Session Fixation vulnerability in Drupal Two-factor Authentication (TFA) allows Session Fixation.This issue affects Two-factor Authentication (TFA): from 0.0.0 before 1.8.0.
-
Critical 10.0
PHP Session Fixation
Session Fixation vulnerabilities allow an attacker to fix a users session identifier before login providing an opportunity for session takeover on a product. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02
-
Critical 9.1CVE-2023-52268 Public exploit
The End-User Portal module before 1.0.65 for FreeScout sometimes allows an attacker to authenticate as an arbitrary use…
-
Critical 9.1
Apache Kylin: Session fixation in web interface
Session Fixation vulnerability in Apache Kylin. This issue affects Apache Kylin: from 2.0.0 through 4.x. Users are recommended to upgrade to version 5.0.0 or above, which fixes the issue.
-
Critical 9.3
Session Hijacking in Oceanic Software's ValeApp
Session Fixation vulnerability in Oceanic Software ValeApp allows Brute Force, Session Hijacking. This issue affects ValeApp: before v2.0.0.
-
Critical 10.0
Fiber Session Middleware Token Injection Vulnerability
Fiber is an Express-inspired web framework written in Go A vulnerability present in versions prior to 2.52.5 is a session middleware issue in GoFiber versions 2 and above. This vulnerability allows users to supply their own session_id value, resulting in the …
-
Critical 9.8
Enonic XP Session Fixation Vulnerability
Enonic XP versions less than 7.7.4 are vulnerable to a session fixation issue. An remote and unauthenticated attacker can use prior sessions due to the lack of invalidating session attributes.
-
Critical 9.8
Insecure Permissions vulnerability in icmsdev iCMS v.7.0.16 allows a remote attacker to obtain sensitive information.
-
Critical 9.8
A privilege escalation issue was found in PHP Gurukul Hospital Management System In v.4.0 allows a remote attacker to e…
-
Critical 9.8
A security vulnerability has been discovered in the implementation of 2FA on the rocket.chat platform, where other acti…
-
Critical 9.8CVE-2021-36394 Public exploit
Moodle Session Fixation vulnerability
In Moodle, a remote code execution risk was identified in the Shibboleth authentication plugin.
-
Critical 9.8
Session fixation vulnerability in Jenkins Bitbucket OAuth Plugin
Jenkins Bitbucket OAuth Plugin 0.12 and earlier does not invalidate the previous session on login.