Skip to content
OpenAdvisories

Weakness (CWE)

CWE-488: Exposure of Data Element to Wrong Session

Base Draft

The product does not sufficiently enforce boundaries between the states of different sessions, causing data to be provided to, or used by, the wrong session.

How to prevent it (3 mitigations)

  1. Architecture and Design

    Protect the application's sessions from information leakage. Make sure that a session's data is not used or visible by other sessions.

  2. Testing

    Use a static analysis tool to scan the code for information leakage vulnerabilities (e.g. Singleton Member Field).

  3. Architecture and Design

    In a multithreading environment, storing user data in Servlet member fields introduces a data access race condition. Do not use member fields to store information in the Servlet.

Source: MITRE CWE-488

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-86411

    FTP connection reuse inherits client-certificate

    An `ftp://` transfer configured with `CURLUSESSL_NONE` can reuse a pooled FTP control connection that a previous easy handle upgraded with `STARTTLS` and authenticated using a client certificate. The second handle performs neither a new TLS handshake nor a ne…

    curl curl curl curl Debian Alpine
  • Critical 9.8
    CVE-2026-19931

    Negotiate ambient user conn reuse

    A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated con…

    curl curl curl curl Debian Alpine
  • Critical 10.0
    CVE-2026-16326

    consul-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode

    In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may allow one client's Consul authentication token to be used for subsequent requests from other clients. This vulnerability (CVE-2026-16326) is f…

    HashiCorp Tooling
  • Critical 10.0
    CVE-2026-16498

    terraform-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode

    The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the streamable-HTTP stateless transport mode that may allow one user's Terraform token to be used to execute tool calls on behalf of subsequent users. This…

    HashiCorp Tooling
  • Critical 9.1
    CVE-2026-9098

    CVE-2026-9098

    In Casdoor versions 2.362.0 and earlier, the SAML callback handler in controllers/auth.go accepts any well-formed SAMLResponse sent to /api/acs without verifying that it corresponds to an AuthnRequest previously issued by Casdoor. Additionally, if an administ…

    Casdoor Casdoor github.com/casdoor/casdoor Go
  • Critical 9.1
    CVE-2025-47928 Public exploit

    Spotipy repo vulnerable to secrets exfiltration via `pull_request_target`

    Spotipy is a Python library for the Spotify Web API. As of commit 4f5759dbfb4506c7b6280572a4db1aabc1ac778d, using `pull_request_target` on `.github/workflows/integration_tests.yml` followed by the checking out the head.sha of a forked PR can be exploited by a…

    spotipy-dev spotipy spotipy Ubuntu
  • Critical 9.1
    CVE-2024-27455

    In the Bentley ALIM Web application, certain configuration settings can cause exposure of a user's ALIM session token w…