Skip to content
OpenAdvisories

Weakness (CWE)

CWE-384: Session Fixation

Compound Incomplete

Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

More detail

Such a scenario is commonly observed when:

- A web application authenticates a user without first invalidating the existing session, thereby continuing to use the session already associated with the user.

- An attacker is able to force a known session identifier on a user so that, once the user authenticates, the attacker has access to the authenticated session.

- The application or container uses predictable session identifiers.

In the generic exploit of session fixation vulnerabilities, an attacker creates a new session on a web application and records the associated session identifier. The attacker then causes the victim to associate, and possibly authenticate, against the server using that session identifier, giving the attacker access to the user's account through the active session.

How to prevent it (3 mitigations)

  1. Architecture and Design

    Invalidate any existing session identifiers prior to authorizing a new user session.

  2. Architecture and Design

    For platforms such as ASP that do not generate new values for sessionid cookies, utilize a secondary cookie. In this approach, set a secondary cookie on the user's browser to a random value and set a session variable to the same value. If the session variable and the cookie value ever don't match, invalidate the session, and force the user to log on again.

  3. Operation

    Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth [REF-1481].

Source: MITRE CWE-384

All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • Critical 9.4
    CVE-2026-102489 Exploited Public exploit EPSS 50%

    Undisclosed RCE in Zammad v6.3 and higher

    Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework.

    zammad zammad
    KEV Oct 2, 2026
  • Low 3.3
    CVE-2025-65681 Public exploit

    Overhang Tutor Discloses Sensitive Information due to Improper Cache-Control

    An issue was discovered in Overhang.IO (tutor-open-edx) (overhangio/tutor) 20.0.2 allowing local unauthorized attackers to gain access to sensitive information due to the absence of proper cache-control HTTP headers and client-side session checks.

    tutor PyPI
  • Medium 6.5
    CVE-2025-55668 Public exploit

    Apache Tomcat: session fixation via rewrite valve

    Session Fixation vulnerability in Apache Tomcat via rewrite valve. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. Older, EOL versions may also be affected. Users are recommended …

    Apache Software Foundation Apache Tomcat tomcat9 tomcat8 Debian Ubuntu Maven
  • Medium 6.3
    CVE-2025-8517 Public exploit

    givanz Vvveb session fixiation

    A vulnerability was detected in givanz Vvveb 1.0.6.1. Impacted is an unknown function. The manipulation results in session fixiation. The attack can be launched remotely. The exploit is now public and may be used. Upgrading to version 1.0.7 is recommended to …

    givanz Vvveb
  • Medium 6.9
    CVE-2025-51471 Public exploit EPSS 19%

    Ollama vulnerable to Cross-Domain Token Exposure

    Cross-Domain Token Exposure in server.auth.getAuthorizationToken in Ollama 0.6.7 allows remote attackers to steal authentication tokens and bypass access controls via a malicious realm value in a WWW-Authenticate header returned by the /api/pull endpoint.

    github.com/ollama/ollama Go
  • Critical 9.8
    CVE-2025-52689 Public exploit EPSS 17%

    Weak Session ID Check in the OmniAccess Stellar Web Management Interface

    Successful exploitation of the vulnerability could allow an unauthenticated attacker to obtain a valid session ID with administrator privileges by spoofing the login request, potentially allowing the attacker to modify the behaviour of the access point.

    Alcatel-Lucent OmniAccess Stellar Products
  • Critical 9.8
    CVE-2022-40916 Public exploit

    Tiny File Manager v2.4.7 and below is vulnerable to session fixation.

  • Critical 9.1
    CVE-2023-52268 Public exploit

    The End-User Portal module before 1.0.65 for FreeScout sometimes allows an attacker to authenticate as an arbitrary use…

  • Unscored —
    CVE-2023-21238 Public exploit

    In visitUris of RemoteViews.java, there is a possible leak of images between users due to a confused deputy. This could…

    Google Android Android
  • Critical 9.8
    CVE-2021-36394 Public exploit

    Moodle Session Fixation vulnerability

    In Moodle, a remote code execution risk was identified in the Shibboleth authentication plugin.

    moodle/moodle moodle Web / CMS Ubuntu Packagist